Ask First

Origin Header

The Origin header names the asking site.

highlighted = computed this step

Origin names the asking site

The Origin row is the site that wants to call this toy API.

Origin=https://app.example\text{Origin}=\text{https://app.example}
Origin headerThe preflight request, allow response, and checks are recomputed from pinned bytes.Origin header - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

Origin is separate from Host

Host names the API server; Origin names the asking page.

Host and Origin checked separately\text{Host and Origin checked separately}
Origin headerThe preflight request, allow response, and checks are recomputed from pinned bytes.Origin header - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

The exact request bytes are pinned

The table rows come from parsing the request hex, not from prose.

request hex parsed\text{request hex parsed}
Origin headerThe preflight request, allow response, and checks are recomputed from pinned bytes.Origin header - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

Summary

The preflight question includes the asking origin.

origin checked\text{origin checked}
Origin headerThe preflight request, allow response, and checks are recomputed from pinned bytes.Origin header - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty