Przejdź do głównej zawartości

Function: originAllowlistValidator()

originAllowlistValidator(allowedOrigins): OriginValidator

Factory that returns an OriginValidator which passes when the parsed Origin host matches one of the entries in allowedOrigins.

Each entry may be a full origin URL (https://shop.example.com) or a bare hostname (shop.example.com). The factory normalizes both forms to the hostname for comparison.

Use this predicate when deploying without a reverse proxy that sets X-Forwarded-Host, or when hosting one storefront on multiple hostnames (custom apex + platform subdomain). When a custom domain is added to the merchant's shop, the integrator must redeploy with the new hostname in the list — for runtime-synced allowlists prefer trustedForwardedHostValidator behind a reverse proxy.

Parameters​

allowedOrigins​

string[]

Returns​

OriginValidator

Example​

// app/api/auth/set-token/route.ts
import {
  createSetTokenHandler,
  originAllowlistValidator,
} from '@doswiftly/storefront-sdk';

export const POST = createSetTokenHandler({
  isTrustedOrigin: originAllowlistValidator([
    'https://shop.example.com',
    'shop-example.doswiftly.pl',
  ]),
});