ConduitMcp.Plugs.OriginValidation (ConduitMCP v0.9.4)

Copy Markdown View Source

Plug that validates the Origin request header against an allowlist.

Reads the allowlist from conn.private[:allowed_origins]. Behavior:

  • nil or "*" — no restriction, all origins allowed
  • A list of strings — only those origins are allowed
  • OPTIONS requests always pass (CORS preflight)
  • Requests without an Origin header pass (browser-less clients don't send it)
  • Disallowed origins receive a 403 JSON error response