Reads a request's Origin header into a normalized origin (scheme://host[:port]).
Returns undefined when the header is absent, repeated, blank, opaque (null, which sandboxed
frames and privacy-sensitive redirects send), or anything other than a parseable http(s) origin.
Ports are kept as sent: browsers omit default ports from Origin, and allowlist entries pass
through the same NormalizeOrigin, so both sides agree without rewriting.
Reads a request's
Originheader into a normalized origin (scheme://host[:port]).Returns undefined when the header is absent, repeated, blank, opaque (
null, which sandboxed frames and privacy-sensitive redirects send), or anything other than a parseable http(s) origin. Ports are kept as sent: browsers omit default ports fromOrigin, and allowlist entries pass through the same NormalizeOrigin, so both sides agree without rewriting.