Function authenticateOrigin

accept.go:228–260

(r *http.Request, originHosts []string)

}

func authenticateOrigin(r *http.Request, originHosts []string) error {
	origin := r.Header.Get("Origin")
	if origin == "" {
		return nil
	}

	u, err := url.Parse(origin)
	if err != nil {
		return fmt.Errorf("failed to parse Origin header %q: %w", origin, err)
	}

	if strings.EqualFold(r.Host, u.Host) {
		return nil
	}

	for _, hostPattern := range originHosts {
		target := u.Host
		if strings.Contains(hostPattern, "://") {
			target = u.Scheme + "://" + u.Host
		}
		matched, err := match(hostPattern, target)
		if err != nil {
			return fmt.Errorf("failed to parse path pattern %q: %w", hostPattern, err)
		}
		if matched {
			return nil
		}
	}
	if u.Host == "" {
		return fmt.Errorf("request Origin %q is not a valid URL with a host", origin)
	}
	return fmt.Errorf("request Origin %q is not authorized for Host %q", u.Host, r.Host)
}

func match(pattern, s string) (bool, error) {
	return path.Match(strings.ToLower(pattern), strings.ToLower(s))