Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/thatdeveloperguy-website / server/security/origin-policy.ts |
| Date | Not specified in source |
| Repository | Janady13/thatdeveloperguy-website |
| Revision | 2bea2ebdff0e34494bff597d4fa9c8422a0c3a94 |
| Branch | main |
| Path or archive member | server/security/origin-policy.ts |
| Original SHA-256 | 9a5697d239ce6dcd0ae1123e0c53e5c295f9a59accfdb9521f919aba3296a206 |
| Git blob SHA | 11a95e3b2a8351a53be1926211fbf6da62016449 |
| Reading-copy SHA-256 | 9a5697d239ce6dcd0ae1123e0c53e5c295f9a59accfdb9521f919aba3296a206 |
Recovered source transcript
Download complete source text ↓13 lines · 0.7 KB
import type { FastifyRequest } from 'fastify';
/** Same-origin submissions only. Browsers send Origin on form POSTs and fetches; a missing Origin with a foreign Referer is refused too. */
export function originAllowed(request: FastifyRequest, allowed: string[]): boolean {
const fetchSite = request.headers['sec-fetch-site'];
if (typeof fetchSite === 'string' && fetchSite !== 'same-origin' && fetchSite !== 'none') return false;
const origin = request.headers.origin;
if (typeof origin === 'string') return allowed.includes(origin);
const referer = request.headers.referer;
if (typeof referer === 'string') { try { return allowed.includes(new URL(referer).origin); } catch { return false; } }
return false;
}