/Wiki/sources/honojs__hono/2026/https-hono-dev-llms-full-txt-origin-string-strin-3f4dc48ca4f2-origin-string-string-function-s0144-c0000.md
origin: `string` | `string[]` | `Function` - hono-docs
origin: string | string[] | Function Source evidence: /Sources/raw/honojs hono/honojs hono.md Canonical citation: https://hono.dev/llms full.txt origin strin...
origin: string | string[] | Function
Source evidence: /Sources/raw/honojshono/honojshono.md Canonical citation: https://hono.dev/llms-full.txt#origin-string-string-function
Summary
Specify allowed origins for CSRF protection. - string: Single allowed origin (e.g., 'https://example.com') - string[]: Array of allowed origins - Function: Custom handler `(origin: string, context: Context) => boolean...
Content
Specify allowed origins for CSRF protection.
string: Single allowed origin (e.g.,'https://example.com')string[]: Array of allowed originsFunction: Custom handler(origin: string, context: Context) => booleanfor flexible origin validation and bypass logic
Default: Only same origin as the request URL
The function handler receives the request's Origin header value and the request context, allowing for dynamic validation based on request properties like path, headers, or other context data.