Skip to main content

origin_allowed

ws_kit::origin

Function origin_allowed 

Source 
pub fn origin_allowed(origin: Option<&str>, allowed_origins: &[String]) -> bool
Expand description

REQ-WSKIT-200/REQ-WSKIT-201: decides whether a WebSocket upgrade request may proceed, based on its Origin.

  • Empty allow-list (default): everything is allowed — including a missing Origin header (REQ-WSKIT-201, documented residual risk, matches pre-0.3.0 behavior so existing users don’t break).
  • Non-empty allow-list: the request’s Origin must be present and normalize-match at least one entry exactly — a missing Origin header is rejected; the check must happen before on_upgrade.

No wildcard/suffix matching: entries match after normalization only.