The Origin Header

P("Struggler") ?

已于 2024-05-25 14:56:06 修改

阅读量496

点赞数 11

分类专栏： Nnix with ME & GPT Security & ME & GPT 文章标签： WEB HTTP

于 2024-05-25 14:51:59 首次发布

本文链接：https://blog.csdn.net/weixin_38233104/article/details/139197577

版权

Security & ME & GPT 同时被 2 个专栏收录

73 篇文章 1 订阅

订阅专栏

Nnix with ME & GPT

2 篇文章 0 订阅

订阅专栏

The Origin header is a vital security feature in HTTP requests. It conveys the essential information about the source (origin) of a request to the server that receives it. This origin is comprised of three parts:

Scheme: This indicates the protocol used, like HTTP or HTTPS.
Hostname: This is the domain name of the website making the request (e.g., "www.example.com").
Port (optional): If a non-standard port is used (usually 80 for HTTP and 443 for HTTPS), it's also included in the Origin header.

Key Points:

Origin vs. Referer: The Origin header differs from the Referer header in a crucial way. While the Referer includes the entire URL with the path, the Origin omits the path information. This is done to prevent sensitive data, potentially within the path, from being revealed.
Browser-controlled: The browser automatically adds the Origin header to specific requests. Users cannot modify it directly.
When is it Sent? The Origin header is primarily included in two scenarios:
- Cross-Origin Requests: Whenever a web page requests resources (scripts, images, etc.) from a different domain than its own, the Origin header is mandatory. This helps enforce security restrictions between domains (covered in CORS).
- Same-Origin Requests (Modern Browsers): In some modern browsers, the Origin header might also be included in same-origin requests, particularly for methods like PUT, POST, and DELETE.

Role in CORS (Cross-Origin Resource Sharing)

The Origin header plays a central role in CORS, a security mechanism that governs how browsers handle requests between different domains. By including the Origin header, the browser informs the server about the request's origin. The server can then check its CORS configuration (using Access-Control-Allow-Origin header) to determine whether to allow or restrict the request based on its origin.