supabase / auth / 17928243696

69%

push

github

fix(oauth2): switch to Origin header for request validation (#2174)

## Summary
Replace `Referer` header validation with `Origin` header in
`validateRequestOrigin` function. Referer was unintended at the
beginning. Using `Origin` header as it's automatically set by browsers
for cross-origin requests. This is a very basic attempt to prevent cross
domain malicious calls.

Key changes:
- Check `Origin` header instead of `Referer` header
- Allow empty `Origin` header (for backend/mobile app initiated
requests)
- Add comprehensive test coverage for new validation behavior

7 of 7 new or added lines in 1 file covered. (100.0%)

12954 of 19082 relevant lines covered (67.89%)

65.59 hits per line