When a request is made to a website, the user-agent (browser) will add a Host
header to the request. The value of this header will be domain name that the request is made to. This header can be used by the server to distinguish which website you are trying to visit, for instance when the same server hosts multiple websites.
If you are using a reverse proxy, the the Host
header will contain the value of the reverse proxy itself. In order to know to the original host, the X-forwarded-Host
can be used. This header contains what the proxy initially received as Host
.
Example: If you make a GET request to https://stackoverflow.com
, the Host
(or after the proxy X-forwarded-Host
) header will always have the value stackoverflow.com
.
The Origin
header is not related to this. This header tells you from which site the request is made.
For instance, if you have a <form>
on example.com
that makes a POST request to stackoverflow.com
, the Host
will be stackoverflow.com
(the domain the request is sent to), while the Origin
will have the value https://example.com
.
For a demonstration you can visit this link: https://jsfiddle.net/parcqhn4/
If you open the "Network" tab in your developer tools and hit the "Submit" button, you can see that the Host
header contains the value example.com
(which is in the action
of the <form>
) while the Origin
contains the value https://fiddle.jshell.net
(which is container that the Fiddle runs in).