sameSite
sameSite(
header,allow?):boolean
Same-site check for a socket upgrade (and any route that hands out a pass): Origin required, its host must be the host the request came to
(the scheme is not compared: behind a TLS proxy the app sees http), and with an allow list it must be on it. Sec-Fetch-Site, when sent, must say
same-origin. header reads one request header by lower-case name.
Parameters
Section titled “Parameters”header
Section titled “header”(name) => string | undefined
allow?
Section titled “allow?”string[] = []
Returns
Section titled “Returns”boolean