Origin Validation
Origin validation for the iframe nginx proxy.
Validate a request origin
GET
/v1/projects/validate-originUsed by the iframe nginx auth_request subrequest. Checks whether the
X-Request-Origin header value is in the configured ALLOWED_ORIGINS
list. On success the X-Allowed-Origins response header carries the
allow-list for CSP frame-ancestors.
A missing or empty X-Request-Origin is refused with 403. The endpoint
does not substitute a default origin.
Responses are sent with res.sendStatus, so the body is the plain-text
status phrase rather than JSON.