Variable: trustedForwardedHostValidator

const trustedForwardedHostValidator: OriginValidator

Pre-built OriginValidator that passes when the parsed Origin host matches a hostname set by a trusted reverse proxy.

Reads X-Forwarded-Host first (RFC 7239 de-facto standard, multiple values are comma-separated — the first entry is the original client-facing host). Falls back to X-Original-Host (a header the DoSwiftly dispatch worker emits alongside X-Forwarded-Host).

Safety: this predicate is only spoof-resistant when invoked inside a runtime that sits behind a trusted intermediary which OVERWRITES these headers on every inbound request (the dispatch worker calls headers.set(...), not append, so a client-sent value is replaced). Browsers cannot set X-Forwarded-* from JS — these are forbidden request headers per fetch spec — so CSRF requests from a malicious origin cannot forge them.

Use this predicate when deploying behind the DoSwiftly dispatch worker, Vercel, NGINX, or any reverse proxy that strips/rewrites Host while preserving Origin.

Example

// app/api/auth/set-token/route.ts
import {
  createSetTokenHandler,
  trustedForwardedHostValidator,
} from '@doswiftly/storefront-sdk';

export const POST = createSetTokenHandler({
  isTrustedOrigin: trustedForwardedHostValidator,
});

Example​

Example