The server-side practice of verifying the Origin header in HTTP requests to prevent cross-origin attacks.