Same-Origin Navigation Checker (utils/sameOriginNavigation.ts)

Validates whether a request is a same-origin navigation using Sec-Fetch-Site or Referer headers, used to CSRF-gate state-changing GET routes.

// Source: https://github.com/triggerdotdev/trigger.dev | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Whether `request` is an unambiguously same-origin navigation, used to
 * CSRF-gate state-changing GET routes. `allowedOrigin` is the dashboard origin
 * (caller passes `env.LOGIN_ORIGIN`, kept out so the rule stays testable).
 *
 * Deny-by-default: prefer `Sec-Fetch-Site: same-origin` when present, otherwise
 * require a `Referer` whose origin matches `allowedOrigin`. Anything
 * missing/cross-site/unparseable returns `false`.
 */
export function isSameOriginNavigation(request: Request, allowedOrigin: string): boolean {
  const fetchSite = request.headers.get("sec-fetch-s

... (truncated -- full source via MCP)