Function isSameOriginPost

telemetry-dashboard/src/auth.ts:165–173

(request: Request)

 * cross-site POST; this is the belt to that pair of braces.
 */
export function isSameOriginPost(request: Request): boolean {
  const origin = request.headers.get('origin');
  if (!origin) return true; // Absent on some legitimate non-browser clients (curl).
  try {
    return new URL(origin).host === new URL(request.url).host;
  } catch {
    return false;
  }
}