Fetch Metadata Request Headers

Fetch Metadata fields describe the browser context that initiated a request.

Use Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-User, and Sec-Fetch-Dest as defense-in-depth signals for navigation, same-origin, same-site, and cross-site requests.

httpbrowsersecurityheaders

Reference (http)

Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty

Use Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-User, and Sec-Fetch-Dest as defense-in-depth signals for navigation, same-origin, same-site, and cross-site requests.

Common mistakes

Treating Fetch Metadata as an authentication mechanism or assuming every client sends these fields.

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet