wikimedia / mediawiki

			// Log if a request with a non-whitelisted Origin header is seen

			// with session cookies.

			$originHeader = $request->getHeader( 'Origin' );

			if ( $originHeader === false ) {

				$origins = [];

			} else {

				$originHeader = trim( $originHeader );

				$origins = preg_split( '/\s+/', $originHeader );

			}

			$sessionCookies = array_intersect(

				array_keys( $_COOKIE ),

				MediaWiki\Session\SessionManager::singleton()->getVaryCookies()

			// Origin: header is a space-separated list of origins, check all of them

			$originHeader = $request->getHeader( 'Origin' );

			if ( $originHeader === false ) {

				$origins = [];

			} else {

				$originHeader = trim( $originHeader );

				$origins = preg_split( '/\s+/', $originHeader );

			}

			if ( !in_array( $originParam, $origins ) ) {

				// origin parameter set but incorrect