An `Origin` header arrives as the literal `null` after a request followed a redirect across hosts — what produced that value?

The arrivals board calls one departures host. That host answers a subscription call with a redirect to a second host that serves the live feed. The first hop arrives carrying the board's origin; the hop after the redirect arrives carrying the literal string `null`, and nothing in the board's own source changed between them. ## Redirect taint A request does not simply forget where it came from when it is redirected. It carries a taint that records whether the chain it has followed has stayed inside one origin. When a hop takes the request to an origin that the chain has not been within, the request's origin is replaced by a tainted one, and the serialization that produces the header value has only one thing it is permitted to emit for it: ``` origin-or-null = serialized-origin / %s"null" ; case-sensitive ``` The `%s` prefix on that token is not decoration — it marks the string as case-sensitive, so the value is exactly `null` in lower case and `NULL` is a different, wrong token. ## What the final host actually receives ```http POST /v1/subscribe HTTP/1.1 Host: api.departures.example Origin: https://board.example.org ``` and, after the chain crosses into another host: ```http POST /v1/subscribe HTTP/1.1 Host: feeds.departures.example Origin: null ``` The field is still there. Its value is four ASCII bytes that identify nobody. This is the distinction that makes the failure confusing: - **A value of `null`** is a present field carrying a deliberate token, produced because the caller identity was discarded. - **No field at all** is a different situation with different causes — for instance a safe-method request that never needed one. - **A JSON `null` in a body** is a third thing entirely and shares nothing with either but the spelling. ## Why the identity is discarded rather than preserved The purpose of the value is to name the security context that initiated the request so that the receiving host can make a decision about it. Once a chain has been bounced through an origin the initiator did not choose, carrying the initiator's name forward would attribute a request to a context that no longer controls where it went. The specification's answer is to stop naming anyone: the request continues, and it continues anonymously. The practical consequences are worth stating plainly: 1. **No allow-list entry can match it as an origin.** `null` is not a serialized origin; it is the token used in place of one, and it is not the name of any host. 2. **The failure appears one hop after the change that caused it.** The redirect is often introduced by an infrastructure change — a feed moved to a second host, a path retired — and the board's code is untouched, so the board is the first place people look and the last place the cause is. 3. **It is not a browser defect and not a stripped field.** The value was produced deliberately by the serialization, and it will be produced identically every time that chain is followed. 4. **Reproducing the first hop alone hides it.** A request issued directly at the final host carries whatever its sender chose and never acquires the taint, so the reproduction succeeds while the real path fails. ## Diagnosing it Read the chain, not just the last request. The question to answer is whether any hop moved the request to a host outside the origin it started in; the first hop that does is the one that replaced the identity. The repair is nearly always structural rather than a configuration edit: have the caller address the host that will actually serve the response, so the chain never crosses a boundary and the request keeps its serialized origin the whole way. ## Not the only producer of that value Redirect taint is the reason the token appears in this scenario, and it is worth knowing that it is not the sole way a request can end up without a namable initiating context — a document can be in a state where its origin has no host to serialize either. What matters for reading a wire capture is the shape of the conclusion: **the token names no one**, so whatever decision the receiving host makes, it makes without knowing who called.