originMatches()

The pure origin matcher behind the webclient wire’s inbound validation and the configured-origin check. No side effects; safe to use in your own origin logic.

1. Signature

originMatches(expected: string, actual: string): boolean;

Returns false for an empty expected and for "*" (which is never accepted).

2. Matching rules

Case Behavior

File-origin group

The string "null" (the desktop-app host’s opaque-origin serialization) plus the legacy file:-page serializations file://, file:/// and file form one group; members match bidirectionally (any member vs. any member). A file-group origin never matches a non-file origin and vice versa.

Both are URLs

Parsed with new URL(…​); they match when scheme, host and port are all equal.

Not both URLs

Fallback: exact string equality.

3. Example

originMatches('https://enaio.example.com', 'https://enaio.example.com'); // true
originMatches('https://enaio.example.com', 'https://other.example.com'); // false
originMatches('null', 'file://');   // true  (same origin group)
originMatches('file://', 'null');   // true  (bidirectional)
originMatches('*', 'https://enaio.example.com'); // false — never accepted

See also WebclientWire (where the matcher is applied) and the origin guide (where the configured value comes from).