Cybersecurity glossary
What is Sec-Fetch-Mode?
Learn what the Sec-Fetch-Mode request header means, how values like navigate, cors, and no-cors describe request behavior, and how it differs from Sec-Fetch-Site, Sec-Fetch-User, and Sec-Fetch-Dest.
Definition
Sec-Fetch-Mode is a Fetch Metadata request header that tells the server how the browser issued the request—such as a top-level navigation, a CORS subresource fetch, or a no-cors embed—so servers can apply policy before handling the response.
Why Sec-Fetch-Mode matters
Cross-site request forgery, confused-deputy endpoints, and unintended state-changing GETs often share a pattern: the browser issues a request the server never meant to accept from that context. Sec-Fetch-Mode gives origins a machine-readable hint about the fetch algorithm in use before expensive work runs.
Unlike Sec-Fetch-Site (which answers “how related are the initiator and target origins?”) or Sec-Fetch-User (which answers “did a human gesture start this navigation?”), Sec-Fetch-Mode answers “what kind of fetch is this?”—navigation, CORS subresource, opaque embed, same-origin XHR, or WebSocket upgrade.
How Sec-Fetch-Mode works
Browsers attach Sec-Fetch-Mode on outgoing requests. Servers read it alongside other Fetch Metadata headers to allow or block patterns that do not match route policy.
User or script initiates a fetch
A navigation, fetch(), form submission, or subresource load selects a fetch mode in the browser.
Browser sets Sec-Fetch-Mode
The mode value (navigate, cors, no-cors, same-origin, websocket) is added to the request headers.
Server evaluates policy
Origin logic checks whether that mode is allowed for the path, method, and content type.
Allow or reject early
Unexpected combinations—such as cors on an admin-only HTML route—can be blocked before mutation.
Complement other controls
Fetch Metadata augments CSRF tokens, SameSite cookies, and authorization—not replaces them.
Common Sec-Fetch-Mode values
navigate
Top-level document navigation—the browser is loading or replacing a page.
cors
Cross-origin fetch that participates in CORS; response is readable when allowed.
no-cors
Cross-origin embed-style request with opaque response; typical for images, scripts, and stylesheets.
same-origin
Same-origin subresource fetch using the same-origin fetch mode.
websocket
WebSocket handshake request upgrading the connection.
Mode vs site vs user vs dest
| Header | What it answers | Example signal |
|---|---|---|
| Sec-Fetch-Mode | How was the request issued? | navigate vs cors vs no-cors |
| Sec-Fetch-Site | What is the initiator–target site relationship? | cross-site vs same-origin |
| Sec-Fetch-User | Was navigation user-activated? | ?1 on click, ?0 on redirect |
| Sec-Fetch-Dest | What resource type is requested? | document vs script vs image |
Defense patterns
- Block state-changing requests when Sec-Fetch-Mode is cors or no-cors on routes meant only for navigations.
- Require navigate (and often Sec-Fetch-User: ?1) for sensitive GET actions that change state.
- Combine mode checks with Sec-Fetch-Site: cross-site + cors on a cookie-authenticated POST is a classic CSRF shape.
- Do not rely on Sec-Fetch-Mode alone; non-browser clients can omit or forge headers.
- Log and alert on repeated policy violations to catch scanners and exploit attempts.
- Test with real browsers; DevTools shows Fetch Metadata on each request.
- Document expected mode/site/dest tuples per route class in your security review checklist.
Limits and pitfalls
Fetch Metadata is a browser affordance. API clients, curl, and compromised extensions are not required to send accurate values. Some privacy tools strip Sec-* headers entirely.
Another pitfall is conflating headers: rejecting cross-site when you meant to reject cors mode—or blocking no-cors image loads on public CDN paths—breaks legitimate traffic.
The practical takeaway
Sec-Fetch-Mode tells servers whether a request is a navigation, a CORS API call, an opaque embed, a same-origin subresource fetch, or a WebSocket upgrade. Pair it with Sec-Fetch-Site, Sec-Fetch-User, and Sec-Fetch-Dest for layered policy, and always keep CSRF tokens and proper authorization as the real enforcement layer.
Related security terms
Sec-Fetch-Site
Describes cross-site vs same-origin relationship, not how the request was issued.
Sec-Fetch-User
Signals whether a navigation was triggered by a user gesture.
Cross-Origin Resource Sharing (CORS)
The cross-origin access model that cors mode participates in.
Same-Origin Policy (SOP)
The baseline isolation model fetch modes build on.
Frequently asked questions
What is Sec-Fetch-Mode in simple terms?
It is a browser-added header that says what kind of fetch the request is—for example a full page load (navigate), a cross-origin API call (cors), or a passive embed (no-cors). Servers can read it to decide whether the request pattern is expected.
How is Sec-Fetch-Mode different from Sec-Fetch-Site?
Sec-Fetch-Mode describes how the request was made (navigate, cors, no-cors, and so on). Sec-Fetch-Site describes the relationship between the page that started the request and the target URL (same-origin, same-site, cross-site, or none).
How is Sec-Fetch-Mode different from Sec-Fetch-User?
Sec-Fetch-Mode classifies the fetch algorithm. Sec-Fetch-User only appears on navigations and indicates whether the navigation was triggered by an explicit user action such as a click.
How is Sec-Fetch-Mode different from Sec-Fetch-Dest?
Sec-Fetch-Mode answers how the request was issued. Sec-Fetch-Dest answers what type of resource is being requested (document, script, image, empty, and similar). Both are Fetch Metadata headers but capture different dimensions.
What does navigate mean?
navigate means a top-level navigation fetch—the kind that loads a new document in a browsing context, such as following a link or submitting a form that replaces the page.
Can servers trust Sec-Fetch-Mode?
Browsers set it and non-browser clients may omit or spoof it. Treat it as a useful signal for defense in depth alongside CSRF tokens, SameSite cookies, and authorization checks—not as a sole security boundary.
References
Explore authoritative guidance and frameworks related to sec-fetch-mode.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.