Classify a request's Origin — falling back to Referer — against the
server's own origin and an explicit trust list.
Behind a reverse proxy the server origin is only correct when the app sets
trust proxy; req.protocol and req.host then read the forwarded values,
which is what the browser actually put in Origin.
A header that is present but does not parse — Origin: null from a
sandboxed frame, a relative Referer — is foreign, not absent. Absent
means the request carried no origin signal at all; a signal that fails to
name this origin is not the same thing.
Classify a request's
Origin— falling back toReferer— against the server's own origin and an explicit trust list.Behind a reverse proxy the server origin is only correct when the app sets
trust proxy;req.protocolandreq.hostthen read the forwarded values, which is what the browser actually put inOrigin.A header that is present but does not parse —
Origin: nullfrom a sandboxed frame, a relativeReferer— isforeign, notabsent. Absent means the request carried no origin signal at all; a signal that fails to name this origin is not the same thing.