( origin: string | undefined, host: string | undefined, allowed: readonly string[], )
| 70 | * - otherwise → allowed only when the full origin string is in `allowed`. |
| 71 | */ |
| 72 | export function isOriginAllowed( |
| 73 | origin: string | undefined, |
| 74 | host: string | undefined, |
| 75 | allowed: readonly string[], |
| 76 | ): boolean { |
| 77 | const oh = originHost(origin); |
| 78 | if (oh === undefined) { |
| 79 | return true; |
| 80 | } |
| 81 | if (host !== undefined && stripPort(oh) === stripPort(host)) { |
| 82 | return true; |
| 83 | } |
| 84 | // `origin` is defined here (originHost returned a host), so the whitelist |
| 85 | // match is against the full origin string (scheme + host). |
| 86 | return allowed.includes(origin as string); |
| 87 | } |
| 88 | |
| 89 | /** |
| 90 | * Build the Fastify `onRequest` CORS hook. |
no test coverage detected