• HTTP
  • HTTP
  • A typical HTTP session
  • HTTP caching
  • HTTP conditional requests
  • Protocol upgrade mechanism
  • HTTP Observatory
  • Permissions Policy Experimental
  • CORS errors
    1. Reason: CORS header 'Origin' cannot be added
    2. Reason: CORS request not HTTP
    3. Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
    4. Reference
    5. Accept-Encoding
    6. Accept-Ranges
    7. Access-Control-Allow-Origin
    8. Access-Control-Request-Method
    9. Alt-Used
    10. Attribution-Reporting-Eligible Experimental
    11. Attribution-Reporting-Register-Source Experimental
    12. Attribution-Reporting-Register-Trigger Experimental
    13. Connection
    14. Content-DPR Non-standard Deprecated
    15. Content-Location
    16. Content-Type
    17. Critical-CH Experimental
    18. Date
    19. DNT Non-standard Deprecated
    20. Downlink Experimental
    21. DPR Non-standard Deprecated
    22. Early-Data Experimental
    23. ECT Experimental
    24. Expect-CT Deprecated
    25. Host
    26. If-Range
    27. Link
    28. NEL Experimental
    29. No-Vary-Search Experimental
    30. Observe-Browsing-Topics Experimental Non-standard
    31. Origin-Agent-Cluster Experimental
    32. Permissions-Policy Experimental
    33. Pragma Deprecated
    34. Range
    35. Report-To Non-standard Deprecated
    36. Reporting-Endpoints Experimental
    37. RTT Experimental
    38. Save-Data Experimental
    39. Sec-Browsing-Topics Experimental Non-standard
    40. Sec-CH-Prefers-Color-Scheme Experimental
    41. Sec-CH-Prefers-Reduced-Motion Experimental
    42. Sec-CH-Prefers-Reduced-Transparency Experimental
    43. Sec-CH-UA Experimental
    44. Sec-CH-UA-Arch Experimental
    45. Sec-CH-UA-Bitness Experimental
    46. Sec-CH-UA-Form-Factors Experimental
    47. Sec-CH-UA-Full-Version Deprecated
    48. Sec-CH-UA-Full-Version-List Experimental
    49. Sec-CH-UA-Mobile Experimental
    50. Sec-CH-UA-Model Experimental
    51. Sec-CH-UA-Platform Experimental
    52. Sec-CH-UA-Platform-Version Experimental
    53. Sec-CH-UA-WoW64 Experimental
    54. Sec-Fetch-User
    55. Sec-GPC Experimental
    56. Sec-WebSocket-Key
    57. Server-Timing
    58. Set-Cookie
    59. Set-Login Experimental
    60. Speculation-Rules Experimental
    61. Supports-Loading-Mode Experimental
    62. Tk Non-standard Deprecated
    63. Upgrade-Insecure-Requests
    64. Viewport-Width Non-standard Deprecated
    65. Warning Deprecated
    66. Width Non-standard Deprecated
    67. X-DNS-Prefetch-Control Non-standard
    68. X-Forwarded-For Non-standard
    69. X-Forwarded-Host Non-standard
    70. X-Forwarded-Proto Non-standard
    71. X-Permitted-Cross-Domain-Policies Non-standard
    72. X-Powered-By Non-standard
    73. X-Robots-Tag Non-standard
    74. X-XSS-Protection Non-standard Deprecated
  • GET
  • POST
  • 100 Continue
  • 200 OK
  • 204 No Content
  • 208 Already Reported
  • 302 Found
  • 308 Permanent Redirect
  • 403 Forbidden
  • 407 Proxy Authentication Required
  • 411 Length Required
  • 415 Unsupported Media Type
  • 421 Misdirected Request
  • 425 Too Early
  • 431 Request Header Fields Too Large
  • 502 Bad Gateway
  • 506 Variant Also Negotiates
  • 511 Network Authentication Required
  • CSP: block-all-mixed-content Deprecated
  • CSP: fenced-frame-src Experimental
  • CSP: frame-src
  • CSP: object-src
  • CSP: prefetch-src Non-standard Deprecated
  • CSP: report-uri Deprecated
  • CSP: require-trusted-types-for Experimental
  • CSP: script-src-elem
  • CSP: trusted-types Experimental
  • Permissions-Policy directives Experimental
    1. Permissions-Policy: accelerometer Experimental
    2. Permissions-Policy: ambient-light-sensor Experimental
    3. Permissions-Policy: attribution-reporting Experimental
    4. Permissions-Policy: autoplay Experimental
    5. Permissions-Policy: bluetooth Experimental
    6. Permissions-Policy: browsing-topics Experimental Non-standard
    7. Permissions-Policy: camera Experimental
    8. Permissions-Policy: compute-pressure Experimental
    9. Permissions-Policy: cross-origin-isolated Experimental
    10. Permissions-Policy: display-capture Experimental
    11. Permissions-Policy: document-domain Experimental
    12. Permissions-Policy: encrypted-media Experimental
    13. Permissions-Policy: fullscreen Experimental
    14. Permissions-Policy: gamepad Experimental
    15. Permissions-Policy: geolocation Experimental
    16. Permissions-Policy: gyroscope Experimental
    17. Permissions-Policy: hid Experimental
    18. Permissions-Policy: identity-credentials-get Experimental
    19. Permissions-Policy: idle-detection Experimental
    20. Permissions-Policy: local-fonts Experimental
    21. Permissions-Policy: magnetometer Experimental
    22. Permissions-Policy: microphone Experimental
    23. Permissions-Policy: midi Experimental
    24. Permissions-Policy: otp-credentials Experimental
    25. Permissions-Policy: payment Experimental
    26. Permissions-Policy: picture-in-picture Experimental
    27. Permissions-Policy: publickey-credentials-create Experimental
    28. Permissions-Policy: publickey-credentials-get Experimental
    29. Permissions-Policy: screen-wake-lock Experimental
    30. Permissions-Policy: serial Experimental
    31. Permissions-Policy: speaker-selection Experimental
    32. Permissions-Policy: storage-access Experimental
    33. Permissions-Policy: usb Experimental
    34. Permissions-Policy: web-share Experimental
    35. Permissions-Policy: window-management Experimental
    36. Permissions-Policy: xr-spatial-tracking Experimental
  • fetch metadata request header indicates the purpose for which the requested resource will be used, when that purpose is something other than immediate use by the user-agent.

    The only purpose that is currently defined is prefetch, which indicates that the resource is being requested in anticipation that it will be needed by a page that is likely to be navigated to in the near future, such as a page linked in search results or a link that a user has hovered over. The server can use this knowledge to: adjust the caching expiry for the request, disallow the request, or perhaps to treat it differently when counting page visits.

    The header is sent when a page is loaded that has a rel="prefetch". Note that if this header is set then a Accept header should match the value used for normal navigation requests.

    Header type Fetch Metadata Request Header
    Forbidden request header Yes (Sec- prefix)
    CORS-safelisted request header No
  • Syntax

    http
    Sec-Purpose: prefetch
    

    Directives

    The allowed tokens are:

    prefetch

    The purpose is to prefetch a resource that may be needed in a probable future navigation.

    Examples

    A prefetch request

    Consider the case where a browser loads a file with a <link> element that has the attribute rel="prefetch" and an href attribute containing the address of an image file. The resulting fetch() should result in an HTTP request where Sec-Purpose: prefetch, Sec-Fetch-Dest: empty, and an Accept value that is the same as the browser uses for page navigation.

    An example of such a header (on Firefox) is given below:

    http
    GET /images/some_image.png HTTP/1.1
    Host: example.com
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate, br
    Sec-Purpose: prefetch
    Connection: keep-alive
    Sec-Fetch-Dest: empty
    Sec-Fetch-Mode: no-cors
    Sec-Fetch-Site: same-origin
    Pragma: no-cache
    Cache-Control: no-cache
    

    Note: At time of writing Firefox incorrectly sets the Accept header as Accept: */* for prefetches. The example has been modified to show what the Accept value should be. This issue can be tracked in Firefox bug 1836334.

    Specifications

    Specification
    Prefetch
    # sec-purpose-header

    Browser compatibility

    BCD tables only load in the browser

    See also