Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker.

When we send an ajax request using JS from another domain with our spoofed referer and origin header it won't really be spoofed. The browser would still send the legit header to the server.

My question is, why is it so that we can't spoof both these headers while sending cross domain requests?

  • Are you asking why these headers cannot be set (because the specification says so) or are you asking what the intend is that the specification says so (to prevent attacks)? Dec 9 '19 at 20:16
  • 1
    Because the browser says so Dec 9 '19 at 20:21
  • 2
    Could you elaborate what you mean by "why"? It's simply a browser design decision. Browser vendors agreed that certain security restrictions should apply to certain headers.
    – Arminius
    Dec 9 '19 at 20:22
  • Grandma uses a browser, not the command line. browsers disallow a lot of risky behavior to cut down on zombie attacks that command-line tools (for example) don't have to normally contend with.
    – dandavis
    Dec 9 '19 at 22:41

You can't set those headers, because the browsers ignore attempts to set them. Browsers ignore attempts to set them, because they aren't supposed to be script-controlled. The restriction on letting them be script-controlled is for security reasons. If you could set the Origin header, you could break the security guarantees of CORS. Since the whole point of CORS is to open gaps in the same-origin policy for trusted origins only, letting a script (which can be attacker-controlled) spoof the origin is obviously unsafe.

Another question would be: why should XHR/Fetch allow you to set those headers? What legitimate reason is there to do that? There's a good reason to disallow it (breaks a security guarantee, setting us back to the bad old days of JSONP where you couldn't be sure who sent the request), and no good reason to allow it, so of course it's not allowed.


These headers cannot be modified as a safety precaution, the ability to alter them would break a lot of assumptions about how browsers work. There used to be some bugs in flash that would let you do this: https://www.securityfocus.com/archive/1/441014/30/0/threaded

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.