--- title: Understanding the Fetch Metadata HTTP headers:... description: A detailed walkthrough of the four Fetch Metadata HTTP request headers — Sec-Fetch-Dest, Sec-Fetch-Site, Sec-Fetch-Mode, and Sec-Fetch-User — that browsers... canonical: https://daily.dev/posts/understanding-the-fetch-metadata-http-headers-sec-fetch-site-and-friends-erlzmca7a twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Understanding the Fetch Metadata HTTP headers: Sec-Fetch-Site and friends | daily.dev og:description: A detailed walkthrough of the four Fetch Metadata HTTP request headers — Sec-Fetch-Dest, Sec-Fetch-Site, Sec-Fetch-Mode, and Sec-Fetch-User — that browsers... og:url: https://daily.dev/posts/understanding-the-fetch-metadata-http-headers-sec-fetch-site-and-friends-erlzmca7a og:image: https://api.daily.dev/og/posts/ErlZMcA7A.png og:image:alt: Understanding the Fetch Metadata HTTP headers: Sec-Fetch-Site and friends og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Understanding the Fetch Metadata HTTP headers: Sec-Fetch-Site and friends **[.NET Escapades](https://daily.dev/sources/andrewlock)** · 12 min read · 1 upvotes · 0 comments ## Summary A detailed walkthrough of the four Fetch Metadata HTTP request headers — Sec-Fetch-Dest, Sec-Fetch-Site, Sec-Fetch-Mode, and Sec-Fetch-User — that browsers send to give servers context about the origin and nature of requests. Each header's possible values and meanings are explained with concrete examples showing what the headers look like for common scenarios (direct navigation, same-origin resource loads, cross-origin CDN images, JavaScript fetch calls). The post explains how servers can use these headers to implement a Resource Isolation Policy as an additional layer of CSRF defense, complementing anti-CSRF tokens and SameSite cookies. A follow-up post will cover how .NET 11 uses these headers for built-in CSRF protection in ASP.NET Core. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CSRF Protection without Tokens or Hidden Form Fields](https://daily.dev/posts/csrf-protection-without-tokens-or-hidden-form-fields-a651bvhew) · Hacker News · 0 upvotes · 0 comments - [The HTTP security headers every site should send](https://daily.dev/posts/the-http-security-headers-every-site-should-send-skotnz1rg) · Flavio Copes · 1 upvotes · 0 comments - [A modern approach to preventing CSRF in Go– Alex Edwards](https://daily.dev/posts/a-modern-approach-to-preventing-csrf-in-go-alex-edwards-5b32watfz) · Lobsters · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aspnet](https://daily.dev/tags/aspnet) [View this post on daily.dev](https://daily.dev/posts/understanding-the-fetch-metadata-http-headers-sec-fetch-site-and-friends-erlzmca7a) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Understanding the Fetch Metadata HTTP headers: Sec-Fetch-Site and friends","url":"https://daily.dev/posts/understanding-the-fetch-metadata-http-headers-sec-fetch-site-and-friends-erlzmca7a","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/understanding-the-fetch-metadata-http-headers-sec-fetch-site-and-friends-erlzmca7a"},"datePublished":"2026-07-29T10:03:27.267Z","dateModified":"2026-07-29T10:03:48.658Z","description":"A detailed walkthrough of the four Fetch Metadata HTTP request headers — Sec-Fetch-Dest, Sec-Fetch-Site, Sec-Fetch-Mode, and Sec-Fetch-User — that browsers...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bb007279025eeb22157a6ea757e694ca?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bb007279025eeb22157a6ea757e694ca?_a=AQAEuop","isAccessibleForFree":true,"articleSection":".NET Escapades","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":".NET Escapades","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/74ebd66cf7e840b6b29913eae3da9189","url":"https://daily.dev/sources/andrewlock"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/understanding-the-fetch-metadata-http-headers-sec-fetch-site-and-friends-erlzmca7a","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aspnet","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":".NET Escapades","item":"https://daily.dev/sources/andrewlock"},{"@type":"ListItem","position":3,"name":"Understanding the Fetch Metadata HTTP headers: Sec-Fetch-Site and friends"}]} ```