fix: allow external host origin behind HTTP proxy

Accept browser https origins when TLS terminates before an HTTP proxy hop
Honor forwarded external host while rejecting mismatched origins
Add tests for proxy and host matching behavior

packages/web/server/lib/security/request-security.test.js

@@ -46,4 +46,38 @@ describe('request security runtime', () => {
       socket: {},
     })).resolves.toBe(false);
   });
+
+  test('allows the external host when TLS terminates before an HTTP proxy hop', async () => {
+    const runtime = createRuntime();
+
+    await expect(runtime.isRequestOriginAllowed({
+      headers: {
+        origin: 'https://devchamber.example.com',
+        host: 'devchamber.example.com',
+        'x-forwarded-proto': 'http',
+      },
+      socket: {},
+    })).resolves.toBe(true);
+  });
+
+  test('uses the forwarded external host without trusting a different origin', async () => {
+    const runtime = createRuntime();
+    const request = {
+      headers: {
+        host: '127.0.0.1:3000',
+        'x-forwarded-host': 'devchamber.example.com',
+        'x-forwarded-proto': 'http',
+      },
+      socket: {},
+    };
+
+    await expect(runtime.isRequestOriginAllowed({
+      ...request,
+      headers: { ...request.headers, origin: 'https://devchamber.example.com' },
+    })).resolves.toBe(true);
+    await expect(runtime.isRequestOriginAllowed({
+      ...request,
+      headers: { ...request.headers, origin: 'https://evil.example.com' },
+    })).resolves.toBe(false);
+  });
 });