From f89500205503a71edd268a8466f646c73bf0f9fa Mon Sep 17 00:00:00 2001
From: guoyangzhen <upgyz@qq.com>
Date: Mon, 16 Mar 2026 17:57:46 +0800
Subject: [PATCH] fix: ctx.request.origin should respect proxy flag via
 X-Forwarded-Proto

Fixes #1746

The origin getter returned this.req.headers.origin (the CORS Origin header)
which ignores the proxy flag. Changed to construct origin from protocol and
host getters, which already respect X-Forwarded-Proto and X-Forwarded-Host
when app.proxy is true.
---
 lib/request.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/request.js b/lib/request.js
index 7860c40bc..8aeffaf7d 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -96,7 +96,8 @@ module.exports = {
    */
 
   get origin () {
-    return this.req.headers.origin || null
+    if (!this.host) return null
+    return `${this.protocol}://${this.host}`
   },
 
   /**