origin

Internal browser-origin validation shared by every socket upgrade.

The same-origin policy compares the browser’s origin with the origin it reached the app at. Behind a proxy that ends TLS, the app sees plain HTTP, so the scheme comes from x-forwarded-proto and, for proxies that rewrite host, the authority from x-forwarded-host. Trusting them is safe here, unlike for a client’s address: a hostile page cannot set either header on a browser’s socket handshake, and a client outside a browser can send any origin it likes anyway.

Types

Origin

opaque </>

pub opaque type Origin

Policy

</>

pub type Policy {
  SameOrigin
  Allowlist(List(Origin))
}

Constructors

```
SameOrigin
```
```
Allowlist(List(Origin))
```

Values

allowed

</>

pub fn allowed(
  req: request.Request(body),
  policy: Policy,
  required: Bool,
) -> Bool

allowlist

</>

pub fn allowlist(values: List(String)) -> Policy