fn is_same_origin(req: &Request<Body>) -> boolExpand description
True unless the request was initiated by another site. Browser-set
Sec-Fetch-Site cannot be forged by page scripts; Origin is the
fallback for browsers predating it. The fronting proxy’s SameSite=Lax
session cookie also keeps a cross-site POST unauthenticated today, but
that is its configuration, not this code’s, so the check here is the
layer this proxy owns.