The Sec-Fetch-User fetch metadata request header is only sent for requests initiated by user activation, and its value will always be ?1.
A server can use this header to identify whether a navigation request from a document, iframe, etc., was originated by the user.
| Header type | Fetch Metadata Request Header |
|---|---|
| Forbidden header name | yes (prefix Sec-) |
| CORS-safelisted request header | no |
Sec-Fetch-User: ?1
The value will always be ?1. When a request is triggered by something other than a user activation, the spec requires browsers to omit the header completely.
If a user clicks on a page link to another page on the same origin, the resulting request would have the following headers:
Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1
| Specification |
|---|
| Fetch Metadata Request Headers # sec-fetch-user-header |
| Desktop | Mobile | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Chrome | Edge | Firefox | Internet Explorer | Opera | Safari | WebView Android | Chrome Android | Firefox for Android | Opera Android | Safari on IOS | Samsung Internet | |
Sec-Fetch-User |
76 |
79 |
90 |
No |
63 |
No |
76 |
76 |
90 |
54 |
No |
12.0 |
© 2005–2022 MDN contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-User