Method isAllowedOrigin

apps/server/internal/httpserver/security.go:302–326

(r *http.Request, origin string)

}

func (s *Server) isAllowedOrigin(r *http.Request, origin string) bool {
	if origin == "" {
		return true
	}
	normalized := normalizeOrigin(origin)
	if normalized == "" {
		return false
	}
	if normalized == s.requestOrigin(r) {
		return true
	}

	cfg := s.currentConfig()
	for _, allowed := range cfg.AllowedOrigins {
		if normalizeOrigin(allowed) == normalized {
			return true
		}
	}

	if (cfg.DevMode || isLoopbackBind(cfg.Bind)) && isLoopbackOrigin(normalized) {
		return true
	}

	return false
}

func (s *Server) corsMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {