getSessionFromRequest (auth/requestSession.ts)

Extracts user session from HTTP requests with CSRF protection for mutating methods.

// Source: https://github.com/junhoyeo/tokscale | License: MIT | Copyright 2025 Junho Yeo
// Provided via justclaw.it.com; keep this notice with the code.
import { getSession, getSessionFromHeader, type SessionUser } from "./session";
import { getConfiguredPublicOrigin, getPublicOrigin } from "@/lib/seo/urls";

const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);

interface GetSessionFromRequestOptions {
  allowAuthorizationHeader?: boolean;
}

function getAllowedOrigins(): string[] {
  const env = process.env.CSRF_ALLOWED_ORIGINS;
  const origins = env
    ? env.split(",").map((o) => o.trim()).filter(Boolean)
    : [getPublicOrigin(), "http://localhost:3000"];

  // An explicit allowlist should not be widened by the hosted fallback. Add
  // only an explicitly configured 

... (truncated -- full source via MCP)