"origin" is undefined when requests are received from the same server AND when malicious requests are sent from a program

[dancherb]

"origin" is undefined when requests are received from the same server AND when malicious requests are sent from a program

[dougwilson]

Hi @dancherb this module is here to set up rules around the origin header provided by the client, following the CORS specification. The CORS specification is a double-opt-in system where both the client and the server have to opt in (the client by sending the origin header and the server by using something like this module). CORS is an abbreviation of "cross-origin resource sharing" -- for the server to tell the client it's OK to share something that the client otherwise wouldn't. CORS is not a server-side security mechanism, as it 100% relies on data sent by the client and assist the security system in the client.

That's a long way to say: your use-case falls outside of what CORS is for.

To protect against unauthorized sources, you will likely need to implement authentication and authorization.