Method isSameOrigin

lib/Server.js:3245–3303

* @private * @param {{ [key: string]: string | undefined }} headers headers * @returns {boolean} true when is same origin, otherwise false

(headers)

   * @returns {boolean} true when is same origin, otherwise false
   */
  isSameOrigin(headers) {
    if (this.options.allowedHosts === "all") {
      return true;
    }

    const originHeader = headers.origin;

    if (!originHeader) {
      return this.options.allowedHosts === "all";
    }

    if (DEFAULT_ALLOWED_PROTOCOLS.test(originHeader)) {
      return true;
    }

    const origin = this.#parseHostnameFromHeader(originHeader);

    if (origin === null) {
      return false;
    }

    if (this.isHostAllowed(origin)) {
      return true;
    }

    const hostHeader = headers.host;

    if (!hostHeader) {
      return this.options.allowedHosts === "all";
    }

    if (DEFAULT_ALLOWED_PROTOCOLS.test(hostHeader)) {
      return true;
    }

    const host = this.#parseHostnameFromHeader(hostHeader);

    if (host === null) {
      return false;
    }

    if (this.isHostAllowed(host)) {
      return true;
    }

    // Treat all loopback aliases as equivalent: localhost may resolve to
    // 127.0.0.1 or ::1 depending on the OS, causing a false mismatch.
    // Only widen when allowedHosts is "auto" (default) or already permits a
    // loopback alias, so an explicit allow-list excluding loopback is honored.
    const loopbacks = new Set(["localhost", "127.0.0.1", "::1"]);
    const loopbackPermitted =
      this.options.allowedHosts === "auto" ||
      [...loopbacks].some((alias) => this.isHostAllowed(alias));
    if (loopbacks.has(origin) && loopbacks.has(host) && loopbackPermitted) {
      return true;
    }

    return origin === host;