# `Mead.Origin`
[🔗](https://github.com/albertosca/mead/blob/main/lib/mead/origin.ex#L1)

The `Origin` rule of every HTTP surface of the runtime: protection against DNS rebinding and
cross-site WebSocket hijacking.

A request without an `Origin` header (a native client) passes. One with exactly one value passes
when that value is a loopback origin or is listed in the allowed origins; anything else, several
values included, is refused.

# `check`

```elixir
@spec check(Plug.Conn.t(), [String.t()]) :: :ok | :forbidden
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*