Fetch Metadata: using request context to strengthen CSRF defenses

The four Fetch Metadata headers tell servers where a request came from and how its response will be used. Andrew Lock explains Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User to help distinguish, for example, a legitimate navigation from a suspicious cross-site request.

Examples contrast an image loaded from a CDN with a JavaScript fetch() call. Because JavaScript cannot modify these signals, servers can use them in a Resource Isolation Policy as an additional layer of defense against CSRF requests.