Skip to main content

origin_guard

victauri_plugin::auth

Function origin_guard 

Source 
pub async fn origin_guard(
    request: Request<Body>,
    next: Next,
) -> Result<Response<Body>, StatusCode>
Expand description

Axum middleware that blocks requests a web page made a browser send.

Runs before the rate limiter, so a refused request never spends a token (a page looping <img src="http://127.0.0.1:7373/health"> sends no Origin and used to drain the shared bucket until the agent was answered 429).

§Errors

Returns StatusCode::FORBIDDEN if the request carries a Sec-Fetch-Site header other than none (every modern browser marks page-initiated requests; none is a user navigation), or an Origin header that is unreadable or not a localhost origin.