Understanding the Fetch Metadata HTTP headers: Sec-Fetch-Site and friends

In this post I look at the Fetch Metadata HTTP headers that have been part of browsers for several years now. I describe what each of the four headers means, when they're sent, and how you might consider using them. In the next post I look at how .NET 11 is going to use these headers to provide simplifier Cross-Site Request Forgery (CSPF) protection. What are the Fetch Metadata HTTP headers? The Fetch Metadata Request Headers specification was first published in 2019, and has been through many revisions, with the latest version published in 2025. It defines a set of HTTP request headers that browsers can send with HTTP requests so that the server has better context about the request being made. The theory is that it is hard for servers to "know" whether a given HTTP request is "legitimate" in the flow of a normal application, or whether it has been triggered maliciously via a link in an <img> tag, for example. These headers provide that extra context. There are already many additional…