Fetch Metadata headers improve web request security understanding
Fetch Me If You Can: A Comprehensive Analysis of Fetch Metadata
Cryptography and Security
Summary
Web servers try to stop bad cross-site attacks by knowing where browser requests come from, but they often do not have enough information. The authors study Fetch Metadata, a security feature added to browsers that sends extra details with web requests to help servers tell if requests come from safe sources or not. They analyze how widely Fetch Metadata is used on popular websites and how its protections compare to other security methods on the client side. Their work reveals differences between these approaches and highlights some security gaps.
What this means in practice
- •For web security engineers: Detect usage patterns of Fetch Metadata to improve server-side cross-site request defenses effectively.
- •For browser developers: Use insights on Fetch Metadata adoption and security gaps to enhance browser security features and header support.
Authors
Pedro Bernardo, Alex Ploner, Marco Squarcina, Mauro Tempesta, Matteo Maffei
Abstract
Effective server-side defenses against cross-site attacks depend on understanding the context in which browser requests are generated. However, servers often lack the information needed to distinguish legitimate requests from potentially malicious cross-site interactions. Fetch Metadata, a security mechanism introduced in 2019, addresses this limitation by adding a set of HTTP headers to outgoing browser requests. These headers provide servers with information about a request's context and provenance, enabling them to enforce request isolation policies accordingly. However, the extent of Fetch Metadata's real-world adoption and its interaction with existing security mechanisms remain largely unexplored. In this paper, we present the first large-scale measurement study of Fetch Metadata adoption. We analyze the top 1M websites in the Tranco list to detect deployments of Fetch Metadata isolation policies and identify custom policies used in the wild. We then examine how these policies address cross-site threats and assess their security coverage. Finally, we provide the first systematic comparison of Fetch Metadata with existing client-side security mechanisms, revealing security gaps that arise from differences between client-side and server-side enforcement.