Fetch Metadata request headers
Supplies request context that servers can use in a resource-isolation policy.
Support in current browsers
Checked against the current browser versions recorded in MDN browser data 8.1.5.
| Browser | Minimum | Outcome | Reason |
|---|---|---|---|
| Chrome | 155 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Edge | 154 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Firefox | 157 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Safari | 27 | Not supported | At least one required mapped feature is not available at this browser baseline. |
| Chrome for Android | 155 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Firefox for Android | 157 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Safari on iOS | 27 | Not supported | At least one required mapped feature is not available at this browser baseline. |
| Android WebView | 155 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Samsung Internet | 30.0 | Works | Every required mapped BCD feature is available without a recorded qualification. |
How support changed
Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.
Chrome
http.headers.Sec-Fetch-Dest- 1 – 7979 recorded releasesNot supported
- 80 – 15575 recorded releasesWorks
http.headers.Sec-Fetch-Mode- 1 – 7575 recorded releasesNot supported
- 76 – 15579 recorded releasesWorks
http.headers.Sec-Fetch-Site- 1 – 7575 recorded releasesNot supported
- 76 – 15579 recorded releasesWorks
http.headers.Sec-Fetch-User- 1 – 7575 recorded releasesNot supported
- 76 – 15579 recorded releasesWorks
Edge
http.headers.Sec-Fetch-Dest- 12 – 798 recorded releasesNot supported
- 80 – 15474 recorded releasesWorks
http.headers.Sec-Fetch-Mode- 12 – 187 recorded releasesNot supported
- 79 – 15475 recorded releasesWorks
http.headers.Sec-Fetch-Site- 12 – 187 recorded releasesNot supported
- 79 – 15475 recorded releasesWorks
http.headers.Sec-Fetch-User- 12 – 187 recorded releasesNot supported
- 79 – 15475 recorded releasesWorks
Firefox
http.headers.Sec-Fetch-Dest- 1 – 8992 recorded releasesNot supported
- 90 – 15768 recorded releasesWorks
http.headers.Sec-Fetch-Mode- 1 – 8992 recorded releasesNot supported
- 90 – 15768 recorded releasesWorks
http.headers.Sec-Fetch-Site- 1 – 8992 recorded releasesNot supported
- 90 – 15768 recorded releasesWorks
http.headers.Sec-Fetch-User- 1 – 8992 recorded releasesNot supported
- 90 – 15768 recorded releasesWorks
Safari
http.headers.Sec-Fetch-Dest- 1 – 16.336 recorded releasesNot supported
- 16.4 – 2725 recorded releasesWorks
http.headers.Sec-Fetch-Mode- 1 – 16.336 recorded releasesNot supported
- 16.4 – 2725 recorded releasesWorks
http.headers.Sec-Fetch-Site- 1 – 16.336 recorded releasesNot supported
- 16.4 – 2725 recorded releasesWorks
http.headers.Sec-Fetch-User- 1 – 2761 recorded releasesNot supported
Chrome for Android
http.headers.Sec-Fetch-Dest- 18 – 7956 recorded releasesNot supported
- 80 – 15575 recorded releasesWorks
http.headers.Sec-Fetch-Mode- 18 – 7552 recorded releasesNot supported
- 76 – 15579 recorded releasesWorks
http.headers.Sec-Fetch-Site- 18 – 7552 recorded releasesNot supported
- 76 – 15579 recorded releasesWorks
http.headers.Sec-Fetch-User- 18 – 7552 recorded releasesNot supported
- 76 – 15579 recorded releasesWorks
Firefox for Android
http.headers.Sec-Fetch-Dest- 4 – 8973 recorded releasesNot supported
- 90 – 15768 recorded releasesWorks
http.headers.Sec-Fetch-Mode- 4 – 8973 recorded releasesNot supported
- 90 – 15768 recorded releasesWorks
http.headers.Sec-Fetch-Site- 4 – 8973 recorded releasesNot supported
- 90 – 15768 recorded releasesWorks
http.headers.Sec-Fetch-User- 4 – 8973 recorded releasesNot supported
- 90 – 15768 recorded releasesWorks
Safari on iOS
http.headers.Sec-Fetch-Dest- 1 – 16.333 recorded releasesNot supported
- 16.4 – 2725 recorded releasesWorks
http.headers.Sec-Fetch-Mode- 1 – 16.333 recorded releasesNot supported
- 16.4 – 2725 recorded releasesWorks
http.headers.Sec-Fetch-Site- 1 – 16.333 recorded releasesNot supported
- 16.4 – 2725 recorded releasesWorks
http.headers.Sec-Fetch-User- 1 – 2758 recorded releasesNot supported
Android WebView
http.headers.Sec-Fetch-Dest- 1 – 7951 recorded releasesNot supported
- 80 – 15575 recorded releasesWorks
http.headers.Sec-Fetch-Mode- 1 – 7547 recorded releasesNot supported
- 76 – 15579 recorded releasesWorks
http.headers.Sec-Fetch-Site- 1 – 7547 recorded releasesNot supported
- 76 – 15579 recorded releasesWorks
http.headers.Sec-Fetch-User- 1 – 7547 recorded releasesNot supported
- 76 – 15579 recorded releasesWorks
Samsung Internet
http.headers.Sec-Fetch-Dest- 1.0 – 12.129 recorded releasesNot supported
- 13.0 – 30.023 recorded releasesWorks
http.headers.Sec-Fetch-Mode- 1.0 – 11.227 recorded releasesNot supported
- 12.0 – 30.025 recorded releasesWorks
http.headers.Sec-Fetch-Site- 1.0 – 11.227 recorded releasesNot supported
- 12.0 – 30.025 recorded releasesWorks
http.headers.Sec-Fetch-User- 1.0 – 11.227 recorded releasesNot supported
- 12.0 – 30.025 recorded releasesWorks
BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.
What this feature can and cannot do
Helps protect against
- Cross-site request forgery
- Cross-site resource abuse
Does not guarantee
- Requests from clients that do not send the headers
- Authorisation flaws
- Incorrect server-side policy decisions
What you need before using it
- A server-side policy with explicit fallback behaviour
Fallback to keep in place
Retain CSRF tokens, SameSite cookies, origin checks, and ordinary authorisation controls.