The purpose of the origin header in WebSockets is to implement any capabilities that require verification of the requesting origin. This is, of course, valid on

The purpose of the origin header in WebSockets is to implement any capabilities that require verification of the requesting origin. This is, of course, valid only in the context of a legitimate client to server connection (since origin security is meaningless in any other context). So, for example, you could use the origin header to protect against confused deputy vulnerabilities (which are known as CSRF in standard HTTP). You could also use the origin header to implement your own cross-origin access control in a scenario where XHR/CORS is not appropriate or efficient (e.g. an embeddable chat widget).