Browser & Web Performance · Senior · Question 7 of 75

What are Fetch Metadata request headers like `Sec-Fetch-Site` useful for on the server?

1Measuring TTFB on the server
2Choosing an image format for the client
✓Correct answer: Rejecting unexpected cross-site requests early, e.g. a cross-site POST to an API that only your app calls

Explanation

A resource isolation policy that allows same-origin, same-site and none plus navigations blocks many CSRF and XS-Leak attempts.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.