Cybersecurity glossary
What is Sec-Fetch-User?
Learn what the Sec-Fetch-User request header means, when browsers send ?1 vs ?0, how it signals user-activated navigations, and how it differs from Sec-Fetch-Mode, Sec-Fetch-Site, and Sec-Fetch-Dest.
Definition
Sec-Fetch-User is a Fetch Metadata request header sent on navigations to indicate whether the request was triggered by a user activation such as a click, tap, or keyboard submit—?1 for yes and ?0 for no.
Why Sec-Fetch-User matters
Not every navigation reflects deliberate user intent. Redirect chains, <meta http-equiv="refresh">, and attacker-driven top-level navigations can load sensitive URLs without a fresh click. Sec-Fetch-User gives servers a boolean signal—?1 or ?0—about whether the navigation was user-activated.
Unlike Sec-Fetch-Mode (which classifies how the fetch runs) or Sec-Fetch-Site (which classifies origin relationships), Sec-Fetch-User applies only to navigations and answers a narrow question: did a user gesture trigger this particular navigation request?
How Sec-Fetch-User works
Browsers set Sec-Fetch-User on navigation fetches. The value is structured as a structured header field with a single boolean token.
Navigation is scheduled
A link click, form submit, address-bar entry, redirect, or script sets location.
Browser checks user activation
Transient user activation from a recent gesture determines ?1 vs ?0 for this hop.
Sec-Fetch-User is attached
Only navigation requests include the header; subresources never do.
Server evaluates intent
Sensitive GET endpoints can require ?1 to reduce unsolicited navigations.
Combine with site and mode
cross-site + navigate + ?0 on a state-changing route is a strong abuse signal.
Sec-Fetch-User values
?1 (true)
User activation triggered this navigation—click, tap, or keyboard submit with activation.
?0 (false)
No user activation for this hop—common on redirects and scripted navigations.
Navigation only
Absent on images, scripts, fetch(), and XHR; do not expect it on API calls.
Per-hop signal
Each redirect may differ; earlier clicks do not guarantee ?1 on later hops.
User vs mode vs site vs dest
| Header | Applies to | Core meaning |
|---|---|---|
| Sec-Fetch-User | Navigations only | User gesture started this navigation (?1/?0) |
| Sec-Fetch-Mode | Most requests | Fetch algorithm (navigate, cors, …) |
| Sec-Fetch-Site | Requests with initiator | cross-site vs same-origin relationship |
| Sec-Fetch-Dest | Most requests | Resource type (document, script, …) |
When ?1 and ?0 appear
| Scenario | Typical Sec-Fetch-User | Note |
|---|---|---|
| User clicks same-origin link | ?1 | Classic intentional navigation |
| Form submit with Enter | ?1 | User activation present |
| 302 redirect after POST | ?0 | Activation does not carry across hops |
| meta refresh | ?0 | No fresh gesture on that navigation |
| window.location from script | ?0 | Unless tied to recent activation |
| Typed URL in address bar | ?1 | Treated as user-initiated navigation |
Defense checklist
- Consider requiring Sec-Fetch-User: ?1 for dangerous GET actions that should never be prefetched or redirected into blindly.
- Pair with Sec-Fetch-Site: cross-site navigations without ?1 deserve extra scrutiny.
- Do not require ?1 on every authenticated page load—redirect-heavy login flows need exceptions.
- Never use Sec-Fetch-User as the only CSRF control; tokens and SameSite cookies remain essential.
- Test OAuth, SAML, and payment return URLs; they often chain redirects with ?0.
- Remember only browsers send this header; server-side clients can omit it.
- Monitor ?0 hits on sensitive routes to detect automated abuse.
Limits and pitfalls
Redirect-heavy applications break naive “always require ?1” rules. A user who legitimately submits a form may land on the next page with ?0 because the redirect consumed activation.
Sec-Fetch-User also does not detect all deceptive UI: clickjacking may still produce ?1 because the user did click—frame protections and CSP frame-ancestors remain necessary.
The practical takeaway
Sec-Fetch-User marks whether a navigation was user-activated (?1) or not (?0). Use it to tighten policy on sensitive navigations together with Sec-Fetch-Site and Sec-Fetch-Mode, test redirect flows carefully, and keep CSRF defenses as the authoritative layer.
Related security terms
Sec-Fetch-Mode
Classifies fetch type; navigate mode often appears with Sec-Fetch-User.
Sec-Fetch-Site
Reports initiator–target site relationship, not user gesture.
Clickjacking
UI redress attacks where users click without intending the underlying action.
Cross-Site Request Forgery (CSRF)
Forged requests Sec-Fetch-User helps distinguish from real user navigations.
Frequently asked questions
What is Sec-Fetch-User in simple terms?
On page navigations, the browser adds Sec-Fetch-User to say whether a real user action—like clicking a link or pressing Enter in the address bar—started the load. ?1 means yes; ?0 means no.
When is Sec-Fetch-User sent?
Only on navigation requests. Subresource fetches, fetch(), XHR, and WebSocket handshakes do not carry Sec-Fetch-User because they are not top-level navigations.
How is Sec-Fetch-User different from Sec-Fetch-Mode?
Sec-Fetch-Mode describes the fetch algorithm (navigate, cors, no-cors, and so on). Sec-Fetch-User is navigation-only and reports whether a user gesture triggered that navigation.
How is Sec-Fetch-User different from Sec-Fetch-Site?
Sec-Fetch-Site tells you if the request is cross-site, same-site, or same-origin. Sec-Fetch-User tells you whether a human intentionally started the navigation, regardless of site relationship.
How is Sec-Fetch-User different from Sec-Fetch-Dest?
Sec-Fetch-Dest names the requested resource type (document, iframe, and similar). Sec-Fetch-User only signals user activation on navigations and does not describe resource category.
What sends ?0 instead of ?1?
Redirects, meta refresh, programmatic location changes without transient user activation, and some automated navigations typically send ?0 even though the user may have clicked earlier in the chain.
Should sensitive actions require Sec-Fetch-User: ?1?
It can help block drive-by navigations and some CSRF shapes, but redirects legitimately carry ?0. Pair the check with CSRF tokens and avoid breaking OAuth or POST/redirect/GET flows without testing.
References
Explore authoritative guidance and frameworks related to sec-fetch-user.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.