( req: OriginValidationRequest, allowHttpOrigin = false )
| 287 | } |
| 288 | |
| 289 | function getExpectedProtocols( |
| 290 | req: OriginValidationRequest, |
| 291 | allowHttpOrigin = false |
| 292 | ): Array<"http" | "https"> { |
| 293 | const clientFacingProtocol = getClientFacingProtocol(req); |
| 294 | const originProtocol = getOriginProtocolOnExpectedHost(req); |
| 295 | |
| 296 | // Compatibility path: some reverse proxies overwrite X-Forwarded-Proto to http |
| 297 | // even when the browser-facing request is https. In that specific case, trust the |
| 298 | // validated origin protocol for host-matched requests only when explicitly enabled. |
| 299 | if (allowHttpOrigin && clientFacingProtocol === "http" && originProtocol === "https") { |
| 300 | return ["https"]; |
| 301 | } |
| 302 | |
| 303 | return [clientFacingProtocol]; |
| 304 | } |
| 305 | |
| 306 | function getPreferredPublicProtocol( |
| 307 | req: OriginValidationRequest, |
no test coverage detected