https://nalar.dev/tags/fetch-metadata/ Recent content in Fetch Metadata on Nalar Hugo en-us Tue, 15 Sep 2026 00:00:00 +0700 https://nalar.dev/fetch-metadata-makes-cross-site-request-context-visible/ Tue, 15 Sep 2026 00:00:00 +0700 https://nalar.dev/fetch-metadata-makes-cross-site-request-context-visible/ <h1 id="fetch-metadata-makes-cross-site-request-context-visible">Fetch Metadata Makes Cross-Site Request Context Visible</h1> <p>A server receiving an authenticated HTTP request often sees valid cookies, a plausible path, and a method that the application accepts. Those facts do not reveal whether the request began inside the application&rsquo;s own page or was triggered by a document on another site. For endpoints that change state, that missing context has long been central to cross-site request forgery defenses.</p> <p>Fetch Metadata request headers expose part of the context already known to the browser. Headers such as <code>Sec-Fetch-Site</code>, <code>Sec-Fetch-Mode</code>, <code>Sec-Fetch-Dest</code>, and <code>Sec-Fetch-User</code> describe relationships and properties surrounding a request. A server can use those signals to reject request patterns that do not belong to its application architecture.</p>