---
title: "Refuse odd requests from other sites · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/fetch-metadata
updated: 2026-10-20
licence: "All rights reserved"
---

# Refuse odd requests from other sites

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Browsers send `Sec-Fetch-*` headers that say where a request came from. Use them to refuse cross-site requests that are not normal page visits.
- How: In middleware, allow requests with no `Sec-Fetch-Site`, or with `same-origin`, `same-site` or `none`. Also allow cross-site `GET` navigations, except into `object` or `embed`. Answer 403 to the rest. Exempt public APIs and files meant for other sites.
- Check: A cross-site `fetch` to a page fails with 403. A normal link still works.

Example:

```js
function fetchMetadata(req, res, next) {
  const site = req.get('Sec-Fetch-Site');
  if (!site || ['same-origin', 'same-site', 'none'].includes(site)) return next();
  const dest = req.get('Sec-Fetch-Dest');
  if (req.method === 'GET' && req.get('Sec-Fetch-Mode') === 'navigate' && dest !== 'object' && dest !== 'embed') return next();
  res.status(403).end();
}
```

```python
# Flask
@app.before_request
def fetch_metadata():
    site = request.headers.get("Sec-Fetch-Site")
    if not site or site in ("same-origin", "same-site", "none"):
        return None
    navigating = request.method == "GET" and request.headers.get("Sec-Fetch-Mode") == "navigate"
    if navigating and request.headers.get("Sec-Fetch-Dest") not in ("object", "embed"):
        return None
    abort(403)
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/fetch-metadata`.

- Previous: [Refuse to be framed](https://agentwranglers.se/playbook/website/security/frame-ancestors)
- Next: [Keep other sites' windows apart](https://agentwranglers.se/playbook/website/security/cross-origin-isolation)
- [Security](https://agentwranglers.se/playbook/website/security)