/Wiki/sources/honojs__hono/2026/https-hono-dev-llms-full-txt-secfetchsite-string-760b1cab3cb9-secfetchsite-string-string-function-s0145-c0000.md
secFetchSite: `string` | `string[]` | `Function` - hono-docs
secFetchSite: string | string[] | Function Source evidence: /Sources/raw/honojs hono/honojs hono.md Canonical citation: https://hono.dev/llms full.txt secfet...
secFetchSite: string | string[] | Function
Source evidence: /Sources/raw/honojshono/honojshono.md Canonical citation: https://hono.dev/llms-full.txt#secfetchsite-string-string-function
Summary
Specify allowed Sec-Fetch-Site header values for CSRF protection using Fetch Metadata. - string: Single allowed value (e.g., 'same-origin') - string[]: Array of allowed values (e.g...
Content
Specify allowed Sec-Fetch-Site header values for CSRF protection using Fetch Metadata.
string: Single allowed value (e.g.,'same-origin')string[]: Array of allowed values (e.g.,['same-origin', 'none'])Function: Custom handler(secFetchSite: string, context: Context) => booleanfor flexible validation
Default: Only allows 'same-origin'
Standard Sec-Fetch-Site values:
same-origin: Request from same originsame-site: Request from same site (different subdomain)cross-site: Request from different sitenone: Request not from a web page (e.g., browser address bar, bookmark)
The function handler receives the request's Sec-Fetch-Site header value and the request context, enabling dynamic validation based on request properties.
Kinic Wiki