Module origin 

Origin validation for WebSocket upgrades (Cross-Site WebSocket Hijacking defense).

A browser always attaches an Origin header to a WebSocket handshake. A page on any site can open a WebSocket to your endpoint and the browser will ride the victim’s cookies/ambient credentials — unless the server checks that Origin. origin_allowed_in_parts validates the Origin header of the upgrade request against a configured allow-list (WsConfig::allowed_origins) before on_upgrade is called.

Comparison semantics: scheme + host + port exact match after normalization (normalize_origin) — lowercase scheme and host, default ports (http/ws 80, https/wss 443) omitted. No suffix, prefix, or wildcard matching in v1 — an allow-list entry https://example.com does not accept https://evil-example.com, https://example.com.evil.com, or subdomains.

Functions

normalize_origin

Normalizes an Origin header value for comparison.

origin_allowed

REQ-WSKIT-200/REQ-WSKIT-201: decides whether a WebSocket upgrade request may proceed, based on its Origin.

origin_allowed_in_partsaxum

REQ-WSKIT-200: origin_allowed over the Origin header of an upgrade request. Call this in the upgrade handler before WebSocketUpgrade:: on_upgrade; a false result should map to 403 Forbidden.