Function isTrustedOrigin

src/node/http.ts:359–371

(origin: string, trustedOrigins: string[])

 * domain wildcards (same as --proxy-domain).
 */
export function isTrustedOrigin(origin: string, trustedOrigins: string[]): boolean {
  return trustedOrigins.some((trusted) => {
    if (trusted === "*" || trusted === origin) {
      return true
    }
    // *.example.com style: match origin if it is the domain or a subdomain
    if (trusted.startsWith("*.")) {
      const domain = trusted.slice(2).toLowerCase()
      return origin === domain || origin.endsWith("." + domain)
    }
    return false
  })
}

/**
 * Authenticate the request origin against the host.  Throw if invalid.