title: Are there any browsers that set the origin header to "null" for privacy-sensitive contexts?
body: <p>The <a href="https://www.rfc-editor.org/rfc/rfc6454" rel="nofollow noreferrer">Origin spec</a> indicates that the <code>Origin</code> header may be set to &quot;null&quot;. This is typically done when the request is coming from a file on a user's computer rather than from a hosted web page. The spec also states that the Origin may be null if the request comes from a &quot;privacy-sensitive&quot; context.</p>
  <p>My questions: What is a &quot;privacy-sensitive&quot; context, and are there any browsers that exhibit this behavior?</p>
  <p>Here is the full phrasing from the Origin spec:</p>
  <blockquote>
  <p>Whenever a user agent issues an HTTP request from a
  &quot;privacy-sensitive&quot; context, the user agent MUST send the value &quot;null&quot;
  in the Origin header field.</p>
  <p>NOTE: This document does not define the notion of a privacy-sensitive
  context.  Applications that generate HTTP requests can designate
  contexts as privacy-sensitive to impose restrictions on how user
  agents generate Origin header fields.</p>
  </blockquote>