server: Ignore empty / non-existing `Origin` headers (#25756)

Otherwise this gives lots of unnecessary warnings:

  W srv    operator(): (CORS) skip non-localhost origin:

diff --git a/tools/server/server-http.cpp b/tools/server/server-http.cpp
index 24a38452aab73102185c5e0472d9086480cee931..783b01b82d11d876292430984f6cda54058c054c 100644 (file)
--- a/tools/server/server-http.cpp
+++ b/tools/server/server-http.cpp
@@ -283,9 +283,9 @@ bool server_http_context::init(const common_params & params) {
         } else if (params.cors_origins == "localhost") {
             // special case: only reflect the Origin header if it is a localhost origin
             std::string origin = req.get_header_value("Origin");
-            if (origin_is_localhost(origin)) {
+            if (!origin.empty() && origin_is_localhost(origin)) {
                 res.set_header("Access-Control-Allow-Origin", origin);
-            } else {
+            } else if (!origin.empty()) {
                 SRV_WRN("(CORS) skip non-localhost origin: %s\n", origin.c_str());
             }
         } else {