# Fetch Metadata: using request context to strengthen CSRF defenses

Canonical source : [Fetch Metadata: using request context to strengthen CSRF defenses](<https://sebastien.rigaux.be/en/tech-watch/links/fetch-metadata-using-request-context-to-strengthen-csrf-defenses>)

The four Fetch Metadata headers tell servers where a request came from and how its response will be used. Andrew Lock explains `Sec-Fetch-Site`, `Sec-Fetch-Mode`, `Sec-Fetch-Dest`, and `Sec-Fetch-User` to help distinguish, for example, a legitimate navigation from a suspicious cross-site request.

Examples contrast an image loaded from a CDN with a JavaScript `fetch()` call. Because JavaScript cannot modify these signals, servers can use them in a Resource Isolation Policy as an additional layer of defense against CSRF requests.

- Selected on : 2026-11-02

- Resource publication : 2026-07-29

- Entry updated : 2026-11-07T20:32:37+0000

- Format : Article

- Source language : EN

- Credit : Andrew Lock

- Found via : [C\# Digest](<https://csharpdigest.net/>)

Original resource : [Fetch Metadata: using request context to strengthen CSRF defenses](<https://andrewlock.net/understanding-the-fetch-metadata-http-headers-sec-fetch-site-and-friends/>)

Tags : [Security](<https://sebastien.rigaux.be/en/tech-watch/tags/security>)

Available versions : [Français](<https://sebastien.rigaux.be/veille/liens/fetch-metadata-lire-le-contexte-des-requetes-pour-renforcer-la-protection-csrf>) · [English](<https://sebastien.rigaux.be/en/tech-watch/links/fetch-metadata-using-request-context-to-strengthen-csrf-defenses>)

[Back to tech watch](<https://sebastien.rigaux.be/en/tech-watch>)