/**
* A browser always sends Origin on POST; refusing foreign or opaque origins stops another page from filing
* reports in its visitors' names (each visitor would count as a separate reporter).
*/
export function sameOriginReport(request: Request): boolean {
const origin = request.headers.get("origin");
if (!origin || origin === "null") return false;
return origin === new URL(request.url).origin;
}