After running tests on a few browsers on browserscope.org, I noted that neither Firefox or IE have adopted the "Origin" HTTP header.

This header is a useful and valid way of helping prevent CSRF attacks, in my opinion.

Why has it not been universally adopted?

  • Hmm - I agree, probably so similar that it is not worth having this as an independent question. Are there other examples where adoption has been halted because it needs universal adoption to be useful? Oct 27, 2015 at 16:23


Browse other questions tagged .