HTTP headers / request header
Origin
Origin: https://app.example.com
What it does
The scheme+host+port of the page making the request. The heart of CORS: servers compare it against their allowlist.
The gotcha
Browsers attach it automatically and you cannot fake it from JS; tools like cURL can — which is why "it works in cURL but not the browser" usually means CORS.
Debugging headers on a phone
The fastest way to see what Origin is actually doing is to send the request and read both sides raw — ReqPad shows auto-generated and custom headers for every request, on all six protocols, with history. Related references: status codes · Authorization · Accept · Accept-Encoding · Accept-Language · If-None-Match · If-Match
Inspect Origin on a live request.
Build the request, send it, read raw headers and timing — from your iPhone. Free to start.