Skip to main content

require_same_origin

sl_map_web::csrf

Function require_same_origin 

Source 
pub async fn require_same_origin(
    __arg0: State<AppState>,
    req: Request,
    next: Next,
) -> Response
Expand description

Middleware that enforces same-origin policy on state-changing requests.

Safe methods (GET, HEAD, OPTIONS) are forwarded unchanged. Unsafe methods must carry an Origin header matching config.public_base_url (or, as a fallback for clients that omit Origin, a Referer whose origin matches). Requests with neither header, or with a mismatched value, are rejected with Error::Forbidden.