Module origin 

The browser rules (kernel spec §3.3): what every browser route checks before its handler, cookie or not.

• State-changing methods (every method but GET and HEAD): Origin must be public_url’s, and a missing Origin is refused. Before setup there is no public_url, so they are refused outright. The body must be JSON: a Content-Type other than application/json is refused, and so is a body without one. A body-less request (park, logout, revoke) needs no Content-Type.
• GET and HEAD: browsers send no Origin on a same-origin GET, so Sec-Fetch-Site is checked instead: same-origin or none, or absent (a client that is not a browser, or one too old to send it; the SameSite=Strict cookie still keeps cross-site requests out). A present Origin must match.

No GET or HEAD route changes state; one that must is a POST. Accepting a missing Sec-Fetch-Site relies on this.

Host enrollment, the host WebSocket and setup are not browser routes in this sense and sit outside this layer (setup has its own rule).

Functions

browser_rules