Function origin_is_same_server

src/ui/http_server.c:79–86

static char g_cors_json[512]; /* CORS + Content-Type: application/json */

static bool origin_is_same_server(const char *origin, int port) {
    char expected[128];
    int length = snprintf(expected, sizeof(expected), "http://127.0.0.1:%d", port);
    if (length > 0 && (size_t)length < sizeof(expected) && strcmp(origin, expected) == 0)
        return true;
    length = snprintf(expected, sizeof(expected), "http://localhost:%d", port);
    return length > 0 && (size_t)length < sizeof(expected) && strcmp(origin, expected) == 0;
}

static bool origin_matches_host(const char *origin, const char *host, int port) {
    /* Two literal loopback forms only — spelled out so the static URL audit