/** Use the actual Host header; Next may normalize request.url to localhost. */
export function isSameOriginRequest(request: Request): boolean {
  if (request.headers.get("sec-fetch-site") === "cross-site") return false;
  const origin = request.headers.get("origin");
  // Non-browser clients do not necessarily send an Origin header.
  if (!origin) return true;
  try {
    const requestUrl = new URL(request.url);
    const host = request.headers.get("host") ?? requestUrl.host;
    if (!host || /[\s/\\?#@]/.test(host)) return false;
    const expected = new URL(`${requestUrl.protocol}//${host}`);
    const actual = new URL(origin);
    if (actual.username || actual.password || actual.pathname !== "/" || actual.search || actual.hash) {
      return false;
    }
    return actual.origin !== "null" && actual.origin === expected.origin;
  } catch {
    return false;
  }
}