I'm pretty sure you can't set the Origin header yourself. That would kindof defeat the purpose of it. If anything they'd only allow you to specify whether or no

I'm pretty sure you can't set the Origin header yourself. That would kindof defeat the purpose of it. If anything they'd only allow you to specify whether or not to include the header. But I doubt any browser even lets you do that: $.ajax({url:'http:// http:// asdf.com/1,beforeSend:function(xhr,set){xhr.setRequestHeader('Origin', 'http:// http:// realorigin.com)}}) Refused to set unsafe header "Origin" So since you can't force an Origin header to be on all of your legit API requests, you won't be able to differentiate them (using the Origin header) from an attacker with a <script> tag.