Module origin 

The socket’s Origin gate.

A browser page the user did not point at forge can open ws:// to the loopback socket from any tab, and the socket carries the whole effective config - credentials included. Browsers always send an Origin on a WebSocket handshake and pages cannot forge it, so the header is the line between the pages the user meant to reach forge and a drive-by page: the clients forge ships, and whatever the user is serving on their own machine.

Re-exports

use std::net::IpAddr; 🔒

use axum::http::Uri; 🔒

use forge_primitives::server::ServerConfig; 🔒

Constants

SHELL_ORIGINS 🔒

The origins a Tauri webview is served from: tauri://localhost on macOS, http://tauri.localhost on Android and Windows, https://tauri.localhost where the scheme is https.

Functions

allows 🔒

Whether a request’s Origin may open the socket.

is_loopback_host 🔒

Whether host is loopback: the localhost name, or any address in a loopback range. Every form counts, not three literals: 127.0.0.2, an expanded [0:0:0:0:0:0:0:1] and an IPv4-mapped [::ffff:127.0.0.1] are all this machine.

is_loopback_origin 🔒

Whether origin is a page served on the user’s own machine: an http or https origin whose host is loopback, at any port, in every build.

own_origins 🔒

The origins the server itself is reached at, from [server] bind and [server] port. No port is hardcoded: a web client served from the server’s own address is the one origin the config knows.