Origin
The web origin that initiated the request.
Request header (sent by clients) cors
How it works
Browsers send it on cross-origin and state-changing requests. Servers use it for CORS decisions and CSRF checks.
Example
Origin: https://app.example.com
See it live: send any request in Endpoint Client and open the Headers tab, where every response header is explained. Specification: Fetch Standard.
Related headers
Access-Control-Allow-Credentials
Whether the browser may expose the response when the request carried cookies or auth.
Access-Control-Allow-Headers
Request headers a cross-origin page may send.
Access-Control-Allow-Methods
Methods a cross-origin page may use.
Access-Control-Allow-Origin
Which web origin may read this response from browser JavaScript.
Access-Control-Expose-Headers
Response headers that cross-origin JavaScript may read.
Access-Control-Max-Age
How long the browser may cache a preflight result, in seconds.