Function validateOrigin

src/utils/cross-origin.ts:182–245

(
  originHeader: string | undefined,
  hostHeader: string | undefined,
  allowedHosts: Set<string>
)

 * origin is never echoed back into `Access-Control-Allow-Origin`.
 */
export function validateOrigin(
  originHeader: string | undefined,
  hostHeader: string | undefined,
  allowedHosts: Set<string>
): OriginValidation {
  const allowAny = allowedHosts.has(ALLOW_ANY_HOST);

  // 1. Validate the Host header (the rebinding defense — runs unconditionally).
  const trimmedHost = (hostHeader ?? "").trim();
  if (!trimmedHost || INVALID_HOST_CHARS.test(trimmedHost)) {
    return { ok: false, status: 400, message: "Malformed Host header" };
  }

  let hostname: string;
  try {
    hostname = new URL(`http://${trimmedHost}`).hostname.toLowerCase();
  } catch {
    return { ok: false, status: 400, message: "Malformed Host header" };
  }
  if (!hostname) {
    return { ok: false, status: 400, message: "Malformed Host header" };
  }

  if (!allowAny && !allowedHosts.has(hostname)) {
    return {
      ok: false,
      status: 403,
      message:
        `Host '${hostname}' is not allowed. Only loopback is permitted by default; ` +
        `set --allowed-hosts (or DBHUB_ALLOWED_HOSTS) to serve other hostnames. ` +
        `This protects against DNS rebinding.`,
    };
  }

  // 2. Origin is only sent by browsers on cross-origin fetches; non-browser
  //    MCP clients omit it. When present it must also be an allowed host so we
  //    never reflect an untrusted origin in the CORS response.
  if (originHeader === undefined) return { ok: true };

  const trimmedOrigin = originHeader.trim();
  if (!trimmedOrigin) {
    return { ok: false, status: 400, message: "Malformed Origin header" };
  }

  let originHostname: string;
  try {
    originHostname = new URL(trimmedOrigin).hostname.toLowerCase();
  } catch {
    return { ok: false, status: 400, message: "Malformed Origin header" };
  }
  if (!originHostname) {
    return { ok: false, status: 400, message: "Malformed Origin header" };
  }

  if (!allowAny && !allowedHosts.has(originHostname)) {
    return {
      ok: false,
      status: 403,