Origin: where a request was initiated from

Origin is the trustworthy half of the pair with Referer. It carries no path, so it leaks nothing about which page the visitor was on, and page code cannot override it because it sits on the browser's forbidden header list. That combination is what makes it usable in a security decision rather than only in analytics.

Browsers send it on every cross-origin fetch and also on same-origin requests using an unsafe method, which is why a plain form POST to your own site arrives with an Origin header. That behaviour is what allows a server to check the header on every state changing request without breaking ordinary navigation, which never carries one.

The value null appears more often than people expect: a sandboxed iframe without the allow-same-origin token, a page opened directly from the file system, and some redirect chains all produce it. Treating null as trusted is a real vulnerability, because an attacker can arrange for a request to carry it. Treat it as an unknown origin and refuse.

As a request forgery defence, compare the header against your own allowlist on every unsafe method and reject anything that does not match. It complements a token rather than replacing one, since a request from a non-browser client carries no Origin at all and has to be authorised some other way.