Module security 

The checks that keep credentials on the HEY origin, and the redaction that keeps them out of logs.

Functions

is_localhost

Whether a URL points at this machine: localhost, a .localhost name, or a loopback address.

is_same_origin

Whether two URLs share a scheme, host and port, with default ports treated as equal to their explicit form.

redact_headers

A copy of the headers with credentials replaced, for logging.

require_secure_endpoint

Refuses an endpoint that would carry credentials over plain HTTP, unless it is on this machine.