{"record":{"id":"e30ee949c178451c","repo":"headroomlabs-ai/headroom","slug":"cross-origin-request-rejected","errorCode":null,"errorMessage":"cross-origin request rejected","messagePattern":"cross-origin request rejected","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"headroom/proxy/loopback_guard.py","lineNumber":245,"sourceCode":"    but its ``Origin:`` header reflects the page's actual origin. CORS alone\n    does not stop this: CORS only blocks the attacker's JS from *reading* the\n    response, not the server from acting on the request.\n\n    Reject when ``Origin`` is present and does not itself name a loopback\n    host, or is the opaque literal ``\"null\"`` (sandboxed iframe / ``file://``\n    page). Requests with no ``Origin`` header (CLI tools, curl, ``TestClient``,\n    same-origin simple navigations) pass through unchanged -- a real browser\n    always sets ``Origin`` on cross-origin fetch/XHR.\n    \"\"\"\n    if HTTPException is None:  # pragma: no cover - defensive\n        raise RuntimeError(\"FastAPI is required for the same-origin guard\")\n\n    headers = getattr(request, \"headers\", None)\n    origin = headers.get(\"origin\") if headers is not None else None\n    if not origin:\n        return\n    if origin == \"null\":\n        raise HTTPException(status_code=403, detail=\"cross-origin request rejected\")\n    host_part = origin.split(\"://\", 1)[-1].split(\"/\", 1)[0]\n    if not is_loopback_host_header(host_part):\n        raise HTTPException(status_code=403, detail=\"cross-origin request rejected\")\n","sourceCodeStart":227,"sourceCodeEnd":249,"githubUrl":"https://github.com/headroomlabs-ai/headroom/blob/322425c43bffde1ed0b64fecf3cf5951565dd82b/headroom/proxy/loopback_guard.py#L227-L249","documentation":"Error \"cross-origin request rejected\" thrown in headroomlabs-ai/headroom.","triggerScenarios":"Raised when the loopback guard rejects a request whose Origin/Referer indicates a cross-origin (potentially browser-based CSRF/DNS-rebinding) attempt.","commonSituations":"See trigger scenarios.","solutions":["Send the request from the allowed origin/host (loopback) or configure the guard's allowed origins","Remove cross-origin browser headers (Origin/Referer) if calling from a non-browser client","If the rejection is wrong, review the loopback guard configuration"],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"322425c43bffde1ed0b64fecf3cf5951565dd82b","analyzedAt":"2026-08-15T01:03:05.481Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}