Add debug log for origin check

Extracted host detection into a separate function to avoid multiple log
lines on each return.

Author: code-asher

src/node/http.ts

@@ -349,35 +349,48 @@ export function authenticateOrigin(req: express.Request): boolean {
   try {
     origin = new URL(originRaw).host.trim().toLowerCase()
   } catch (error) {
+    logger.debug(`unable to parse malformed origin "${originRaw}"; blocking request to ${req.originalUrl}`)
     return false // Malformed URL.
   }
 
+  // A missing host likely means the reverse proxy has not been configured to
+  // forward the host which means we cannot perform the check.  Emit a warning
+  // so an admin can fix the issue.
+  const host = getHost(req)
+  if (typeof host === "undefined") {
+    logger.warn(`no host headers found; blocking request to ${req.originalUrl}`)
+    return false
+  }
+
+  if (host !== origin) {
+    logger.debug(`host "${host}" does not match origin "${origin}"; blocking request to ${req.originalUrl}`)
+    return false
+  }
+  return true
+}
+
+/**
+ * Get the host from headers.
+ */
+function getHost(req: express.Request): string | undefined {
   // Honor Forwarded if present.
   const forwardedRaw = getFirstHeader(req, "forwarded")
   if (forwardedRaw) {
     const parts = forwardedRaw.split(/[;,]/)
     for (let i = 0; i < parts.length; ++i) {
       const [key, value] = splitOnFirstEquals(parts[i])
       if (key.trim().toLowerCase() === "host" && value) {
-        return origin === value.trim().toLowerCase()
+        return value.trim().toLowerCase()
       }
     }
   }
 
   // Honor X-Forwarded-Host if present.
   const xHost = getFirstHeader(req, "x-forwarded-host")
   if (xHost) {
-    return origin === xHost.trim().toLowerCase()
+    return xHost.trim().toLowerCase()
   }
 
-  // A missing host likely means the reverse proxy has not been configured to
-  // forward the host which means we cannot perform the check.  Emit a warning
-  // so an admin can fix the issue.
   const host = getFirstHeader(req, "host")
-  if (!host) {
-    logger.warn(`no host headers found; blocking request to ${req.originalUrl}`)
-    return false
-  }
-
-  return origin === host.trim().toLowerCase()
+  return host ? host.trim().toLowerCase() : undefined
 }