[ Web Proxy ]
URL:
Viewing: https://javascript.info/task/do-we-need-origin [Back]  [Original]
Why do we need Origin?
EN

We want to make this open-source project available for people all around the world.

Help to translate the content of this tutorial to your language!

[] [] [] []
    BuyEPUB/PDF
    Search on Javascript.info:
    Search in the tutorial:
    Tutorial map
    Light themeDark theme
    DanskEnglishEspaolFranaisIndonesiaItalianoTrkeOzbek
    back to the lesson

    Why do we need Origin?

    importance: 5

    As you probably know, theres HTTP-header Referer, that usually contains an url of the page which initiated a network request.

    For instance, when fetching http://google.com from http://javascript.info/some/url, the headers look like this:

    Accept: */*
Accept-Charset: utf-8
Accept-Encoding: gzip,deflate,sdch
Connection: keep-alive
Host: google.com
Origin: http://javascript.info
Referer: http://javascript.info/some/url

    As you can see, both Referer and Origin are present.

    The questions:

    1. Why Origin is needed, if Referer has even more information?
    2. Is it possible that theres no Referer or Origin, or is it incorrect?
    solution

    We need Origin, because sometimes Referer is absent. For instance, when we fetch HTTP-page from HTTPS (access less secure from more secure), then theres no Referer.

    The Content Security Policy may forbid sending a Referer.

    As well see, fetch has options that prevent sending the Referer and even allow to change it (within the same site).

    By specification, Referer is an optional HTTP-header.

    Exactly because Referer is unreliable, Origin was invented. The browser guarantees correct Origin for cross-origin requests.

    Web Proxy Viewer  |  New URL  |  Original Page