新增 labels 下的韩泰 EOT 标注工作台

labels/eot-studio/lib/request-origin.ts

@@ -0,0 +1,20 @@
+/** Use the actual Host header; Next may normalize request.url to localhost. */
+export function isSameOriginRequest(request: Request): boolean {
+  if (request.headers.get("sec-fetch-site") === "cross-site") return false;
+  const origin = request.headers.get("origin");
+  // Non-browser clients do not necessarily send an Origin header.
+  if (!origin) return true;
+  try {
+    const requestUrl = new URL(request.url);
+    const host = request.headers.get("host") ?? requestUrl.host;
+    if (!host || /[\s/\\?#@]/.test(host)) return false;
+    const expected = new URL(`${requestUrl.protocol}//${host}`);
+    const actual = new URL(origin);
+    if (actual.username || actual.password || actual.pathname !== "/" || actual.search || actual.hash) {
+      return false;
+    }
+    return actual.origin !== "null" && actual.origin === expected.origin;
+  } catch {
+    return false;
+  }
+}