Description
Match token exactly against same-origin, same-site, cross-site, or none.
Web protocol data has several layers: a complete message or URL, individual fields or components, and the literal tokens within them. Delimiter presence, spelling, comparison rules, and parser normalization can affect results. A check of one component needs its stated scope before it can be used in a larger parser or policy decision.
Match token exactly against same-origin, same-site, cross-site, or none.
When to use this tool
Use HTTP Sec Fetch Site One Token when you need one stated URL, header, or protocol-component check in a diagnostic or parser workflow. Supply the input level specified below.
How to use the tool and how it works
- Enter token. Use the units and conventions below.
- Run the tool. Correct any format, range, or cross-field input error before interpreting the output.
- Read valid, site. Inspect valid before interpreting the associated values.
Match token exactly against same-origin, same-site, cross-site, or none. Return valid and preserve an accepted site token; otherwise return site as invalid.1
| Input field | Meaning and units | Accepted input |
|---|---|---|
| token | Token | Required. Text; maximum UTF-16 length 8192. |
| Output field | Interpretation | Returned shape |
|---|---|---|
| valid | Whether this tool’s particular check passes; does not imply broader identifier or protocol validity. | Required. Boolean. |
| site | Site | Required. Text; maximum UTF-16 length 8192. |
{
"input": {
"token": "cross-site"
},
"output": {
"valid": true,
"site": "cross-site"
}
}Limitations and assumptions
- Case and whitespace are significant. The tool checks a supplied label rather than deriving the relationship between sites or authenticating browser-generated Fetch Metadata.
- The field tables state structural bounds; the mechanics also specify cross-field constraints. Malformed inputs and unsupported domains cause errors. A successful false flag, empty branch value, or zero placeholder has the meaning stated above and is distinct from an input error.
Alternative or Complementary methods
Use a complete URL or header parser when the task involves an entire field or message. Test actual browser, server, or cache behavior separately when a security or protocol decision depends on more than this component.
References
Similar or alternative tools
- HTTP Age Cache Freshness Residual
Calculate remaining cache freshness lifetime and mark exact lifetime equality as no longer fresh.
- Web: HTTP Age Date Response Adjustment
Apply RFC9111 apparent-age/response-delay adjustment and resident time from explicit parsed timestamps and Age; not a cache freshness or header parser.