# Origin Header — Syntax, Values & Examples

> Sent by browsers to say which origin — scheme, host and port — a request comes from.

Browsers add Origin to CORS requests and to any request whose method isn't GET or HEAD. Unlike `Referer`, it never includes a path. Servers use it to make CORS decisions and as a cheap CSRF check: a state-changing request whose Origin isn't yours didn't come from your pages.

- Type: Request header
- Category: CORS
- Defined in: [RFC 6454 — The Web Origin Concept](https://www.rfc-editor.org/rfc/rfc6454.html#section-7)

## Syntax

```http
Origin: <scheme>://<host>[:<port>]   or   Origin: null
```

## Examples

```http
Origin: https://app.example.com
```

a page on app.example.com

```http
Origin: null
```

sandboxed iframes, file:// pages, some redirects

## Good to know

- Scripts can't set or change Origin; browsers control it.
- Non-browser clients such as curl don't send it — treat a missing Origin as 'not a browser', not as trusted.
- Compare the full origin, not a substring: `evil-example.com` contains `example.com`.

## Who sets Origin

Browsers set Origin themselves; page scripts can't change it. To simulate one while testing, curl lets you send any value: `curl -H "Origin: https://app.example.com" -I https://api.example.com/`.

## Check it

In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with `>`:

```sh
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
```

## FAQ

### What's the difference between Origin and Referer?

Origin holds only scheme, host and port, and browsers send it for CORS and non-GET requests. Referer can hold the full URL of the previous page and is shaped by Referrer-Policy.

## Related headers

- [Access-Control-Allow-Origin](https://www.devkult.com/headers/access-control-allow-origin.md): Tells the browser which origin may read this response from JavaScript running on another site.
- [Referer](https://www.devkult.com/headers/referer.md): The address of the page that linked to or loaded the requested resource.
- [Host](https://www.devkult.com/headers/host.md): The domain name (and port) the request is for, so one server can host many sites.

## Further reading

- [CORS errors explained](https://www.devkult.com/blog/cors-errors-explained.md)

Open the interactive page: https://www.devkult.com/headers/origin