/**
 * A browser always sends Origin on POST; refusing foreign or opaque origins stops another page from filing
 * reports in its visitors' names (each visitor would count as a separate reporter).
 */
export function sameOriginReport(request: Request): boolean {
  const origin = request.headers.get("origin");
  if (!origin || origin === "null") return false;
  return origin === new URL(request.url).origin;
}