Documentation

Documentation / zerotal / http / isAllowedOrigin

Function: isAllowedOrigin()

isAllowedOrigin(request, allowedOrigins?): boolean

Defined in: packages/core/src/http/originGuard.ts:40

Whether a request's Origin header is acceptable for a credentialed, pipeline-bypassing endpoint.

Parameters

request

Request

The incoming request. Its own URL supplies the server origin.

allowedOrigins?

string[] = []

Additional origins to accept, for deployments where the browser app is served from a different host than the API (e.g. an SPA on app.example.com talking to api.example.com). Compared exactly — no wildcards, no suffix matching, because endsWith(".example.com") also matches evil-example.com.

Returns

boolean

true when the request may proceed.

Example

if (!isAllowedOrigin(req, config('app.wsAllowedOrigins'))) {
  return new Response('Forbidden origin', { status: 403 });
}