Skip to main content

loopback_ws_origin_allowed

reddb_server::server::ui_bridge

Function loopback_ws_origin_allowed 

Source 
pub fn loopback_ws_origin_allowed(
    origin: Option<&str>,
    allowed: &[String],
) -> bool
Expand description

Exact-match, default-deny Origin gate for the loopback /redwire upgrade (ADR 0036, adapted for loopback). An absent Origin is rejected (a browser always sends one); a present origin must appear verbatim in allowed. Kept pure so the policy is unit-tested without a live socket. The WSS-only rule of the internet edge does not apply here — the bridge is 127.0.0.1-bound, so plain ws:// is accepted.