# Sec-Fetch-User header

The HTTP **`Sec-Fetch-User`** [fetch metadata request header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Fetch_metadata) is sent for requests initiated by user activation, and its value is always `?1`.

A server can use this header to identify whether a navigation request from a document, iframe, etc., was originated by the user.

The header is only included in requests to [potentially trustworthy URLs](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts#potentially_trustworthy_urls).

<table class="properties">
  <tbody>
    <tr>
      <th scope="row">Header type</th>
      <td>[Fetch Metadata Request Header](https://developer.mozilla.org/en-US/docs/Glossary/Fetch%20Metadata%20Request%20Header)</td>
    </tr>
    <tr>
      <th scope="row">[Forbidden request header](https://developer.mozilla.org/en-US/docs/Glossary/Forbidden%20request%20header)</th>
      <td>Yes (<code>Sec-</code> prefix)</td>
    </tr>
    <tr>
      <th scope="row">
        [CORS-safelisted request header](https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted%20request%20header)
      </th>
      <td>No</td>
    </tr>
  </tbody>
</table>

## Syntax

```http
Sec-Fetch-User: ?1
```

## Directives

The value will always be `?1`. When a request is triggered by something other than a user activation, the spec requires browsers to omit the header completely.

## Examples

### Using Sec-Fetch-User

If a user clicks on a page link to another page on the same origin, the resulting request would have the following headers:

```http
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
```

## Specifications

## Browser compatibility

## See also

- [Sec-Fetch-Dest](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest), [Sec-Fetch-Mode](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode), [Sec-Fetch-Site](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site) fetch metadata request headers
- [Protect your resources from web attacks with Fetch Metadata](https://web.dev/articles/fetch-metadata) (web.dev)
- [Fetch Metadata Request Headers playground](https://secmetadata.appspot.com/) (secmetadata.appspot.com)