Function createOriginHook

packages/server/src/middleware/origin.ts:97–122

(
  opts: OriginHookOptions,
)

 * fails closed without leaking headers.
 */
export function createOriginHook(
  opts: OriginHookOptions,
): (req: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply | void> {
  const allowed = opts.allowedOrigins ?? [];
  return async (req, reply) => {
    const origin = req.headers.origin;
    if (origin === undefined) {
      return;
    }
    if (isOriginAllowed(origin, req.headers.host, allowed)) {
      reply.header('Access-Control-Allow-Origin', origin);
      reply.header('Access-Control-Allow-Methods', CORS_ALLOW_METHODS);
      reply.header('Access-Control-Allow-Headers', CORS_ALLOW_HEADERS);
      reply.header('Vary', 'Origin');
      if (req.method === 'OPTIONS') {
        return reply.code(204).send();
      }
      return;
    }
    // Origin present but not allowed: emit no CORS headers so the browser
    // blocks the response. Short-circuit the preflight to fail closed.
    if (req.method === 'OPTIONS') {
      return reply.code(204).send();
    }
  };
}