originwhencrossorigin

Origin when cross-origin, often treated as originwhencrossorigin, is a concept in web security describing how browsers indicate the origin of a request when the request crosses origin boundaries and how servers use that information in Cross-Origin Resource Sharing (CORS). It centers on the Origin header and the mechanisms that govern cross-origin interactions.

The Origin header contains the scheme, host, and port of the page that initiated the request, and it is sent by browsers for cross-origin requests. It does not include the full path or query string. In same-origin requests, the Origin header may be absent, while in cross-origin requests it is included to help the server determine whether to allow the interaction.

In the CORS workflow, the server can respond with headers such as Access-Control-Allow-Origin, specifying which origins are permitted. For certain requests, a preflight OPTIONS request is sent to check permissions before the actual request. If credentials are involved, the server must explicitly permit them and cannot use a wildcard for Access-Control-Allow-Origin.

Security and privacy considerations are central to originwhencrossorigin. The Origin header aids in preventing unauthorized cross-origin access, but it can be spoofed by attackers if other protections fail. Servers should validate the origin against a trusted list and combine it with proper authentication and authorization. The header also reduces exposure compared with full URLs in Referer headers, but it does not replace robust security controls.

See also: Cross-Origin Resource Sharing, Origin header, Same-origin policy, Referer header.