http-origin
Origin header validated
shipped
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain http-origin.
- pack
http- weight
- critical
- scope
- server as deployed (the endpoint you configured, with the headers you configured)
- decided by
- http
- since
- 0.2-draft (methodology 0.3-draft)
- config keys
checks.http-origin.enabledchecks.http-origin.severityserver.headersserver.url
Probes
evil-originPOST initialize with Origin: http://sealmark-evil.example and the configured headers, after a control initialize without it
Settings and thresholds
Every check also takes checks.http-origin.enabled and checks.http-origin.severity; they are described once in the configuration reference.
This check has no numeric threshold.
| Key | Default | Standard | Meaning |
|---|---|---|---|
server.headers | none | not locked | HTTP headers sent to the server (url transport). Values under secret-looking names are redacted. |
server.url | none | not locked | URL of a Streamable HTTP server. Alone it must already be running; with command, Sealmark starts it and waits for this URL. |
How the verdict is established
- Scoring. critical and scored: pass = 1 point, part = 0.5, fail = 0. A fail caps the pack's grade at D, whatever the other checks scored.
What to fix
Validate the Origin header against an allow-list and answer 403 for any other origin, on every path and method, with or without a session.
False positives
A server that deliberately serves browser clients from any origin fails; it should validate against an allow-list instead.
False negatives
A server that validates Origin only on some paths or methods, or only when a session exists. Not tested: DNS rebinding through the Host header.