Two issues from before the provider refactor, found by its review.
The redirect guard dropped Authorization, cookies and the providers' key
headers when a redirect left the origin, but kept x-access-code, this site's
own access code; it is dropped too now.
edgeOneEndpoint took the request's Origin header as the site's address.
Behind a proxy the request URL is the internal one and Origin is the site's,
so Origin still wins, but only when its host matches Host or
X-Forwarded-Host; a request carrying another site's Origin now gets the
request's own origin, so the EdgeOne cookies and the access code never travel
to that site.
dayuan.jiang
55a32af76a