A detailed walkthrough of the four Fetch Metadata HTTP request headers — Sec-Fetch-Dest, Sec-Fetch-Site, Sec-Fetch-Mode, and Sec-Fetch-User — that browsers send to give servers context about the origin and nature of requests. Each header's possible values and meanings are explained with concrete examples showing what the headers look like for common scenarios (direct navigation, same-origin resource loads, cross-origin CDN images, JavaScript fetch calls). The post explains how servers can use these headers to implement a Resource Isolation Policy as an additional layer of CSRF defense, complementing anti-CSRF tokens and SameSite cookies. A follow-up post will cover how .NET 11 uses these headers for built-in CSRF protection in ASP.NET Core.
