app/lib/origin.mjs

Functions

Imports

It imports no other module of this repo. Imported by app/routes/admin.tsx, app/routes/search.ask.ts, app/routes/theme.ts, app/routes/workspace.tsx.

Source

1/*
2 * Absent Origin is allowed: only non-browser clients omit it, and they spend their
3 * own IP's allowance; a hostile page cannot omit it. The string "null" (sandboxed
4 * iframe, opaque origin) is refused, unlike a missing header.
5 */
6
7/**
8 * Compared against the request's own origin, not `SITE_ORIGIN`, so it keeps
9 * working on both workers.dev and the apex across the cutover.
10 *
11 * @param {string | null | undefined} origin the `Origin` header, verbatim
12 * @param {string} requestUrl the request's own URL
13 * @returns {{ ok: boolean, reason: string }}
14 */
15export function originVerdict(origin, requestUrl) {
16  if (origin === null || origin === undefined || origin === "") {
17    return { ok: true, reason: "absent" };
18  }
19
20  let self;
21  try {
22    self = new URL(requestUrl).origin;
23  } catch {
24    return { ok: false, reason: "unparseable-request-url" };
25  }
26
27  if (origin === self) return { ok: true, reason: "same-origin" };
28  return { ok: false, reason: "cross-origin" };
29}
30
31export const ASK_ORIGIN_REFUSAL = "Ask does not take cross-origin requests.";
32
33// Deliberately says nothing about what the route does or why it refused.
34export const ORIGIN_REFUSAL = "Cross-origin requests are not accepted.";