Fetch Metadata

Declares the relationship between the request initiator's origin and the requested resource's origin.

• same-origin: Request originates from the same site (e.g., navigation within your app)
• same-site: Request comes from a different scheme but same registrable domain (e.g., http:// to https:// on same domain)
• cross-site: Request originates from a completely different registrable domain
• none: Request is user-initiated (e.g., typing a URL directly, bookmark click)

For AI crawler defense, rejecting all cross-site requests to sensitive API endpoints immediately blocks scraping tools that inject requests from external origins.

Indicates the request's initiation mode, revealing whether the browser expects a navigation, a resource load, or an API-style fetch.

• navigate: Top-level document request (user clicking a link)
• nested-navigate: Request for a nested browsing context like an iframe
• no-cors: Opaque request with limited response access (image, script tags)
• cors: Cross-origin request requiring CORS headers
• websocket: Upgrade request for a WebSocket connection

AI scrapers often use no-cors mode to pull content without triggering CORS preflight checks. Blocking no-cors on HTML endpoints prevents silent data extraction.

Specifies the intended destination of the fetched resource within the browser's processing pipeline.

• document: Full HTML page (top-level navigation)
• iframe: Embedded sub-document
• script, style, image: Sub-resource loads
• empty: Requests initiated via fetch() or XMLHttpRequest
• audio, video, font, worker: Specialized resource types

Requests with dest: empty and site: cross-site are a strong signal of programmatic scraping. Legitimate browser navigations always carry dest: document or dest: iframe.

A boolean header indicating whether the request was triggered by a user activation (a click, tap, or keypress).

• ?1: User-initiated action (genuine human interaction)
• ?0: No user activation (automated or background request)
• Absent: Header not sent (older browser or non-browser client)

Automated crawlers and headless browsers cannot simulate true user activation gestures. Requiring Sec-Fetch-User: ?1 on sensitive endpoints blocks bots that programmatically trigger navigation without real interaction events.

Fetch Metadata headers are most powerful when evaluated together as a composite signal. A single request carrying:

• Sec-Fetch-Site: cross-site
• Sec-Fetch-Mode: no-cors
• Sec-Fetch-Dest: empty
• Sec-Fetch-User: ?0

represents a near-certain automated scraping attempt with no legitimate browser use case. This combination can be rejected at the edge with zero false positives.

Deploy these policies in reverse proxies (NGINX, Envoy) or CDN edge workers to block scraping before it reaches origin infrastructure.

Fetch Metadata headers are supported by all modern Chromium-based browsers (Chrome 76+, Edge 79+) and Firefox 90+. Safari added support in version 16.0.

Critical caveats for AI crawler defense:

• Non-browser clients (Python requests, cURL, headless automation) may omit these headers entirely. Absence itself is a detection signal.
• Spoofing is possible but requires the attacker to know your exact policy logic. Defense-in-depth with TLS fingerprinting (JA4) and IP reputation is essential.
• Legitimate API consumers (mobile apps, server-to-server integrations) won't send Fetch Metadata. Maintain an allowlist for known partners.

An attack that forces an authenticated user's browser to execute unwanted actions on a web application. Fetch Metadata provides a server-side defense layer against CSRF by allowing applications to reject requests that lack the expected Sec-Fetch-Site: same-origin or Sec-Fetch-Site: same-site headers, effectively blocking cross-site form submissions and resource loads that originate from malicious domains.

A browser-enforced mechanism that controls how web pages request resources from a different origin than the one that served the page. While CORS governs client-side permission checks, Fetch Metadata complements it by enabling server-side validation of the request's provenance. Together, they form a defense-in-depth strategy: CORS prevents unauthorized reads, while Fetch Metadata rejects suspicious writes and navigation requests before they reach application logic.

The foundational browser security principle that isolates documents and scripts retrieved from one origin from interacting with resources from another. Fetch Metadata headers make the origin context explicit to the server, allowing applications to enforce policy violations server-side. For example, a request with Sec-Fetch-Site: cross-site attempting to access a JSON endpoint can be immediately blocked, preventing data exfiltration even if the Same-Origin Policy is bypassed through misconfiguration.

A boolean header (?1 or ?0) that indicates whether the request was triggered by a user activation such as a mouse click or keyboard press. This is critical for distinguishing intentional user navigation from automated or scripted requests. Security policies can use this signal to allow cross-site top-level navigations only when Sec-Fetch-User: ?1 is present, blocking <a> tag clicks from being silently triggered by JavaScript-based scrapers or clickjacking overlays.

A proposed security mechanism that allows servers to declare which contexts are permitted to load specific resources. Fetch Metadata serves as the runtime enforcement layer for such policies. By inspecting Sec-Fetch-Dest (e.g., image, script, iframe) and Sec-Fetch-Mode (e.g., navigate, no-cors), servers can reject mismatched requests—such as a <script> tag attempting to load a JSON API endpoint—preventing cross-site data leakage and speculative execution attacks.

Requests where Sec-Fetch-Mode: navigate indicates the browser is loading a new document, typically from a user clicking a link or entering a URL. These requests are the primary target for scraping bots that simulate human browsing. By combining Sec-Fetch-Site: cross-site with Sec-Fetch-Mode: navigate, servers can identify and challenge automated crawlers that traverse a site programmatically, distinguishing them from legitimate same-origin navigation flows.