diff --git a/.changes/http-origin-duplicated.md b/.changes/http-origin-duplicated.md
new file mode 100644
index 00000000..67d1c9b6
--- /dev/null
+++ b/.changes/http-origin-duplicated.md
@@ -0,0 +1,5 @@
+---
+"http": "patch"
+---
+
+Fix `ORIGIN` header containing 2 URLs when `unsafe-headers` feature flag is enabled.
diff --git a/plugins/http/src/commands.rs b/plugins/http/src/commands.rs
index 5c895ebc..ac4b8c6a 100644
--- a/plugins/http/src/commands.rs
+++ b/plugins/http/src/commands.rs
@@ -224,8 +224,8 @@ pub async fn fetch<R: Runtime>(
                     request = request.header(header::USER_AGENT, "tauri-plugin-http");
                 }
 
-                if !(cfg!(feature = "unsafe-headers")
-                    && headers.contains_key(header::ORIGIN.as_str()))
+                if cfg!(feature = "unsafe-headers")
+                    && !headers.contains_key(header::ORIGIN.as_str())
                 {
                     if let Ok(url) = webview.url() {
                         request =