@remix-run/cop-middleware 0.0.0 → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Shopify Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,117 @@
-# Placeholder Package
+# cop-middleware
 
-This package is a placeholder published at `0.0.0` to reserve the npm name and configure CI publish permissions.
+Cross-origin protection middleware for Remix. It mirrors Go's `CrossOriginProtection` by rejecting unsafe cross-origin browser requests without synchronizer tokens.
+
+## Features
+
+- **Browser Provenance Checks** - Uses `Sec-Fetch-Site` when present and falls back to `Origin`
+- **Trusted Origins** - Allow specific cross-origin callers by exact origin
+- **Explicit Escape Hatches** - Support insecure bypass patterns for endpoints like webhooks
+- **No Session State** - Does not require synchronizer tokens or server-side CSRF storage
+
+## Installation
+
+```sh
+npm i remix
+```
+
+## Usage
+
+```ts
+import { createRouter } from 'remix/fetch-router'
+import { cop } from 'remix/cop-middleware'
+
+let router = createRouter({
+  middleware: [cop()],
+})
+```
+
+## Behavior
+
+For unsafe methods (`POST`, `PUT`, `PATCH`, `DELETE`), `cop()` follows the same broad model as Go's `CrossOriginProtection`:
+
+- Allow `Sec-Fetch-Site: same-origin`
+- Allow `Sec-Fetch-Site: none`
+- Reject other `Sec-Fetch-Site` values unless the request matches a trusted origin or insecure bypass
+- If `Sec-Fetch-Site` is missing, compare `Origin` to the request host
+- If both `Sec-Fetch-Site` and `Origin` are missing, allow the request
+
+This middleware is intentionally tokenless. If you cannot guarantee the deployment assumptions behind that model, prefer [`csrf-middleware`](https://github.com/remix-run/remix/tree/main/packages/csrf-middleware).
+
+## Caveats
+
+- `cop()` is a browser-origin guard, not a universal CSRF solution. It is designed for deployments that can rely on modern browser provenance signals and same-origin request handling.
+- If both `Sec-Fetch-Site` and `Origin` are missing on an unsafe request, `cop()` allows the request to continue. This is intentional so older clients and non-browser callers do not fail closed by default.
+- If `Sec-Fetch-Site` is missing, `cop()` only rejects when `Origin` is present and does not match the request host.
+- If you need stronger guarantees for session-backed form workflows, mixed deployment environments, or requests that should not fall through when browser provenance headers are missing, use [`csrf-middleware`](https://github.com/remix-run/remix/tree/main/packages/csrf-middleware) or layer both middlewares together.
+
+## Using with csrf-middleware
+
+You can also layer `cop()` in front of `csrf()` when you want both browser provenance checks and session-backed synchronizer tokens.
+
+```ts
+import { createCookie } from 'remix/cookie'
+import { createRouter } from 'remix/fetch-router'
+import { createCookieSessionStorage } from 'remix/session/cookie-storage'
+import { session } from 'remix/session-middleware'
+import { cop } from 'remix/cop-middleware'
+import { csrf } from 'remix/csrf-middleware'
+
+let sessionCookie = createCookie('__session', { secrets: ['secret1'] })
+let sessionStorage = createCookieSessionStorage()
+
+let router = createRouter({
+  middleware: [cop(), session(sessionCookie, sessionStorage), csrf()],
+})
+```
+
+In this setup, `cop()` runs first and rejects unsafe cross-origin browser requests early using `Sec-Fetch-Site` and `Origin`. Requests that pass `cop()` continue into `csrf()`, which still enforces synchronizer-token validation and origin checks for the remaining traffic.
+
+## Trusted Origins
+
+```ts
+import { createRouter } from 'remix/fetch-router'
+import { cop } from 'remix/cop-middleware'
+
+let router = createRouter({
+  middleware: [
+    cop({
+      trustedOrigins: ['https://admin.example.com'],
+    }),
+  ],
+})
+```
+
+Trusted origins must be exact origin values in the form `scheme://host[:port]`.
+
+## Insecure Bypass Patterns
+
+Bypass patterns intentionally weaken protection for specific endpoints. They support:
+
+- Optional method prefixes, for example `POST /webhooks/{provider}`
+- Exact paths, for example `/healthz`
+- Trailing-slash subtree patterns, for example `/webhooks/`
+- Single-segment wildcards with `{name}`
+- Tail wildcards with `{name...}`
+
+```ts
+import { createRouter } from 'remix/fetch-router'
+import { cop } from 'remix/cop-middleware'
+
+let router = createRouter({
+  middleware: [
+    cop({
+      insecureBypassPatterns: ['POST /webhooks/{provider}', '/healthz'],
+    }),
+  ],
+})
+```
+
+## Related Packages
+
+- [`csrf-middleware`](https://github.com/remix-run/remix/tree/main/packages/csrf-middleware) - Session-backed CSRF protection with synchronizer tokens
+- [`fetch-router`](https://github.com/remix-run/remix/tree/main/packages/fetch-router) - Router for the web Fetch API
+
+## License
+
+See [LICENSE](https://github.com/remix-run/remix/blob/main/LICENSE)

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { cop, type CopDenyHandler, type CopFailureReason, type CopOptions } from './lib/cop.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAA"}

package/dist/index.js

@@ -0,0 +1 @@
+export { cop } from "./lib/cop.js";

package/dist/lib/cop.d.ts

@@ -0,0 +1,39 @@
+import type { Middleware, RequestContext } from '@remix-run/fetch-router';
+/**
+ * Reason reported when cross-origin protection rejects a request.
+ */
+export type CopFailureReason = 'cross-origin-request' | 'cross-origin-request-from-old-browser';
+/**
+ * Custom response handler for rejected cross-origin requests.
+ */
+export interface CopDenyHandler {
+    /**
+     * Builds the response returned when a request is denied.
+     */
+    (reason: CopFailureReason, context: RequestContext): Response | Promise<Response>;
+}
+/**
+ * Configuration for the cross-origin protection middleware.
+ */
+export interface CopOptions {
+    /**
+     * Exact origins that should bypass cross-origin rejection.
+     */
+    trustedOrigins?: readonly string[];
+    /**
+     * Path patterns that should bypass protection for matching requests.
+     */
+    insecureBypassPatterns?: readonly string[];
+    /**
+     * Optional custom response handler for rejected requests.
+     */
+    onDeny?: CopDenyHandler;
+}
+/**
+ * Creates middleware that rejects unsafe cross-origin requests.
+ *
+ * @param options Cross-origin protection options.
+ * @returns Middleware that validates request origin headers.
+ */
+export declare function cop(options?: CopOptions): Middleware;
+//# sourceMappingURL=cop.d.ts.map

package/dist/lib/cop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cop.d.ts","sourceRoot":"","sources":["../../src/lib/cop.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAiB,MAAM,yBAAyB,CAAA;AAaxF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,GAAG,uCAAuC,CAAA;AAE/F;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAElC;;OAEG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE1C;;OAEG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAqFD;;;;;GAKG;AACH,wBAAgB,GAAG,CAAC,OAAO,GAAE,UAAe,GAAG,UAAU,CAWxD"}

package/dist/lib/cop.js

@@ -0,0 +1,221 @@
+import { RequestMethods } from '@remix-run/fetch-router';
+const safeMethods = ['GET', 'HEAD', 'OPTIONS'];
+class CrossOriginProtection {
+    #trustedOrigins = new Set();
+    #insecureBypassPatterns = [];
+    #onDeny;
+    constructor(options = {}) {
+        for (let trustedOrigin of options.trustedOrigins ?? []) {
+            this.addTrustedOrigin(trustedOrigin);
+        }
+        for (let insecureBypassPattern of options.insecureBypassPatterns ?? []) {
+            this.addInsecureBypassPattern(insecureBypassPattern);
+        }
+        this.setDenyHandler(options.onDeny);
+    }
+    addTrustedOrigin(origin) {
+        this.#trustedOrigins.add(validateTrustedOrigin(origin));
+    }
+    addInsecureBypassPattern(pattern) {
+        this.#insecureBypassPatterns.push(parseBypassPattern(pattern));
+    }
+    setDenyHandler(onDeny) {
+        this.#onDeny = onDeny;
+    }
+    check(context) {
+        if (safeMethods.includes(context.method)) {
+            return null;
+        }
+        let secFetchSite = getHeaderValue(context.headers, 'Sec-Fetch-Site')?.toLowerCase() ?? '';
+        switch (secFetchSite) {
+            case '':
+                break;
+            case 'same-origin':
+            case 'none':
+                return null;
+            default:
+                return this.#isRequestExempt(context) ? null : 'cross-origin-request';
+        }
+        let requestOrigin = getHeaderValue(context.headers, 'Origin');
+        if (requestOrigin == null) {
+            return null;
+        }
+        let parsedOrigin = parseOrigin(requestOrigin);
+        if (parsedOrigin != null && parsedOrigin.host === context.url.host) {
+            return null;
+        }
+        return this.#isRequestExempt(context) ? null : 'cross-origin-request-from-old-browser';
+    }
+    deny(reason, context) {
+        if (this.#onDeny) {
+            return this.#onDeny(reason, context);
+        }
+        return new Response(getDefaultErrorMessage(reason), { status: 403 });
+    }
+    #isRequestExempt(context) {
+        for (let pattern of this.#insecureBypassPatterns) {
+            if (matchesBypassPattern(pattern, context)) {
+                return true;
+            }
+        }
+        let requestOrigin = getHeaderValue(context.headers, 'Origin');
+        if (requestOrigin == null) {
+            return false;
+        }
+        let normalizedOrigin = normalizeOrigin(requestOrigin);
+        return normalizedOrigin != null && this.#trustedOrigins.has(normalizedOrigin);
+    }
+}
+/**
+ * Creates middleware that rejects unsafe cross-origin requests.
+ *
+ * @param options Cross-origin protection options.
+ * @returns Middleware that validates request origin headers.
+ */
+export function cop(options = {}) {
+    let protection = new CrossOriginProtection(options);
+    return async (context, next) => {
+        let reason = protection.check(context);
+        if (reason == null) {
+            return next();
+        }
+        return protection.deny(reason, context);
+    };
+}
+function getDefaultErrorMessage(reason) {
+    if (reason === 'cross-origin-request') {
+        return 'Forbidden: cross-origin request detected from Sec-Fetch-Site header';
+    }
+    return 'Forbidden: cross-origin request detected, and/or browser is out of date: Sec-Fetch-Site is missing, and Origin does not match Host';
+}
+function getHeaderValue(headers, name) {
+    let value = headers.get(name);
+    if (value == null) {
+        return null;
+    }
+    let trimmedValue = value.trim();
+    return trimmedValue === '' ? null : trimmedValue;
+}
+function validateTrustedOrigin(origin) {
+    let trimmedOrigin = origin.trim();
+    if (trimmedOrigin === '') {
+        throw new Error('trusted origin must not be empty');
+    }
+    if (trimmedOrigin.endsWith('/')) {
+        throw new Error(`invalid origin ${JSON.stringify(origin)}: trailing slash is not allowed`);
+    }
+    let parsedOrigin = parseOrigin(trimmedOrigin);
+    if (parsedOrigin == null) {
+        throw new Error(`invalid origin ${JSON.stringify(origin)}`);
+    }
+    if (parsedOrigin.pathname !== '/' || parsedOrigin.search !== '' || parsedOrigin.hash !== '') {
+        throw new Error(`invalid origin ${JSON.stringify(origin)}: path, query, and fragment are not allowed`);
+    }
+    return serializeOrigin(parsedOrigin);
+}
+function normalizeOrigin(origin) {
+    let parsedOrigin = parseOrigin(origin);
+    return parsedOrigin == null ? null : serializeOrigin(parsedOrigin);
+}
+function parseOrigin(origin) {
+    try {
+        let parsedOrigin = new URL(origin);
+        if (parsedOrigin.host === '') {
+            return null;
+        }
+        if (parsedOrigin.username !== '' || parsedOrigin.password !== '') {
+            return null;
+        }
+        return parsedOrigin;
+    }
+    catch {
+        return null;
+    }
+}
+function serializeOrigin(origin) {
+    return `${origin.protocol}//${origin.host}`;
+}
+function parseBypassPattern(pattern) {
+    let trimmedPattern = pattern.trim();
+    if (trimmedPattern === '') {
+        throw new Error('bypass pattern must not be empty');
+    }
+    let method = null;
+    let pathname = trimmedPattern;
+    let methodPattern = /^([A-Z]+)\s+(.+)$/.exec(trimmedPattern);
+    if (methodPattern != null && methodPattern[2].startsWith('/')) {
+        let maybeMethod = methodPattern[1];
+        if (!RequestMethods.includes(maybeMethod)) {
+            throw new Error(`invalid request method in bypass pattern ${JSON.stringify(pattern)}`);
+        }
+        method = maybeMethod;
+        pathname = methodPattern[2];
+    }
+    if (!pathname.startsWith('/')) {
+        throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: path must start with "/"`);
+    }
+    if (pathname.includes('?') || pathname.includes('#')) {
+        throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: query strings and fragments are not supported`);
+    }
+    let matchesSubtree = pathname.endsWith('/');
+    let normalizedPathname = pathname.length > 1 && matchesSubtree ? pathname.slice(0, pathname.length - 1) : pathname;
+    let rawSegments = normalizedPathname === '/' ? [] : normalizedPathname.slice(1).split('/');
+    let segments = rawSegments.map((segment, index) => parseBypassSegment(pattern, segment, index === rawSegments.length - 1));
+    return { method, pathname, segments, matchesSubtree };
+}
+function parseBypassSegment(pattern, segment, isLastSegment) {
+    if (segment === '') {
+        throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: empty path segments are not allowed`);
+    }
+    if (!segment.startsWith('{') || !segment.endsWith('}')) {
+        return { type: 'static', value: segment };
+    }
+    let wildcardName = segment.slice(1, segment.length - 1);
+    if (wildcardName === '') {
+        throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: empty wildcards are not allowed`);
+    }
+    if (wildcardName === '$') {
+        throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: "{$}" is not supported in cop-middleware`);
+    }
+    if (wildcardName.endsWith('...')) {
+        if (!isLastSegment) {
+            throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards must be last`);
+        }
+        if (wildcardName.length === 3) {
+            throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards require a name`);
+        }
+        return { type: 'rest' };
+    }
+    return { type: 'wildcard' };
+}
+function matchesBypassPattern(pattern, context) {
+    if (pattern.method != null && pattern.method !== context.method) {
+        return false;
+    }
+    let pathname = context.url.pathname;
+    let hasTrailingSlash = pathname.length > 1 && pathname.endsWith('/');
+    let normalizedPathname = pathname.length > 1 && hasTrailingSlash ? pathname.slice(0, pathname.length - 1) : pathname;
+    let pathSegments = normalizedPathname === '/' ? [] : normalizedPathname.slice(1).split('/');
+    let segmentIndex = 0;
+    while (segmentIndex < pattern.segments.length) {
+        let pathSegment = pathSegments[segmentIndex];
+        let segment = pattern.segments[segmentIndex];
+        if (segment.type === 'rest') {
+            return true;
+        }
+        if (pathSegment == null) {
+            return false;
+        }
+        if (segment.type === 'static' && segment.value !== pathSegment) {
+            return false;
+        }
+        segmentIndex++;
+    }
+    if (pattern.matchesSubtree) {
+        if (pathSegments.length === pattern.segments.length) {
+            return pattern.pathname === '/' || hasTrailingSlash;
+        }
+        return pathSegments.length > pattern.segments.length;
+    }
+    return pathSegments.length === pattern.segments.length && !hasTrailingSlash;
+}

package/package.json

@@ -1,14 +1,52 @@
 {
   "name": "@remix-run/cop-middleware",
-  "version": "0.0.0",
-  "description": "Placeholder package for Remix CI/OIDC setup",
+  "version": "0.1.1",
+  "description": "Middleware for tokenless cross-origin protection in Fetch API servers",
+  "author": "Michael Jackson <mjijackson@gmail.com>",
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/remix-run/remix.git",
     "directory": "packages/cop-middleware"
   },
-  "publishConfig": {
-    "access": "public"
+  "homepage": "https://github.com/remix-run/remix/tree/main/packages/cop-middleware#readme",
+  "files": [
+    "LICENSE",
+    "README.md",
+    "dist",
+    "src",
+    "!src/**/*.test.ts"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "devDependencies": {
+    "@types/node": "^24.6.0",
+    "@typescript/native-preview": "7.0.0-dev.20251125.1",
+    "@remix-run/fetch-router": "0.18.1",
+    "@remix-run/assert": "0.1.0",
+    "@remix-run/test": "0.1.0"
+  },
+  "dependencies": {
+    "@remix-run/fetch-router": "^0.18.1"
+  },
+  "keywords": [
+    "fetch",
+    "router",
+    "middleware",
+    "csrf",
+    "cross-origin",
+    "sec-fetch-site"
+  ],
+  "scripts": {
+    "build": "tsgo -p tsconfig.build.json",
+    "clean": "git clean -fdX",
+    "test": "remix-test",
+    "typecheck": "tsgo --noEmit"
   }
-}
+}

package/src/index.ts

@@ -0,0 +1 @@
+export { cop, type CopDenyHandler, type CopFailureReason, type CopOptions } from './lib/cop.ts'

package/src/lib/cop.ts

@@ -0,0 +1,348 @@
+import { RequestMethods } from '@remix-run/fetch-router'
+import type { Middleware, RequestContext, RequestMethod } from '@remix-run/fetch-router'
+
+const safeMethods: RequestMethod[] = ['GET', 'HEAD', 'OPTIONS']
+
+type BypassSegment = { type: 'static'; value: string } | { type: 'wildcard' } | { type: 'rest' }
+
+interface BypassPattern {
+  method: RequestMethod | null
+  pathname: string
+  segments: BypassSegment[]
+  matchesSubtree: boolean
+}
+
+/**
+ * Reason reported when cross-origin protection rejects a request.
+ */
+export type CopFailureReason = 'cross-origin-request' | 'cross-origin-request-from-old-browser'
+
+/**
+ * Custom response handler for rejected cross-origin requests.
+ */
+export interface CopDenyHandler {
+  /**
+   * Builds the response returned when a request is denied.
+   */
+  (reason: CopFailureReason, context: RequestContext): Response | Promise<Response>
+}
+
+/**
+ * Configuration for the cross-origin protection middleware.
+ */
+export interface CopOptions {
+  /**
+   * Exact origins that should bypass cross-origin rejection.
+   */
+  trustedOrigins?: readonly string[]
+
+  /**
+   * Path patterns that should bypass protection for matching requests.
+   */
+  insecureBypassPatterns?: readonly string[]
+
+  /**
+   * Optional custom response handler for rejected requests.
+   */
+  onDeny?: CopDenyHandler
+}
+
+class CrossOriginProtection {
+  #trustedOrigins = new Set<string>()
+  #insecureBypassPatterns: BypassPattern[] = []
+  #onDeny?: CopDenyHandler
+
+  constructor(options: CopOptions = {}) {
+    for (let trustedOrigin of options.trustedOrigins ?? []) {
+      this.addTrustedOrigin(trustedOrigin)
+    }
+
+    for (let insecureBypassPattern of options.insecureBypassPatterns ?? []) {
+      this.addInsecureBypassPattern(insecureBypassPattern)
+    }
+
+    this.setDenyHandler(options.onDeny)
+  }
+
+  addTrustedOrigin(origin: string): void {
+    this.#trustedOrigins.add(validateTrustedOrigin(origin))
+  }
+
+  addInsecureBypassPattern(pattern: string): void {
+    this.#insecureBypassPatterns.push(parseBypassPattern(pattern))
+  }
+
+  setDenyHandler(onDeny?: CopDenyHandler): void {
+    this.#onDeny = onDeny
+  }
+
+  check(context: RequestContext): CopFailureReason | null {
+    if (safeMethods.includes(context.method)) {
+      return null
+    }
+
+    let secFetchSite = getHeaderValue(context.headers, 'Sec-Fetch-Site')?.toLowerCase() ?? ''
+    switch (secFetchSite) {
+      case '':
+        break
+      case 'same-origin':
+      case 'none':
+        return null
+      default:
+        return this.#isRequestExempt(context) ? null : 'cross-origin-request'
+    }
+
+    let requestOrigin = getHeaderValue(context.headers, 'Origin')
+    if (requestOrigin == null) {
+      return null
+    }
+
+    let parsedOrigin = parseOrigin(requestOrigin)
+    if (parsedOrigin != null && parsedOrigin.host === context.url.host) {
+      return null
+    }
+
+    return this.#isRequestExempt(context) ? null : 'cross-origin-request-from-old-browser'
+  }
+
+  deny(reason: CopFailureReason, context: RequestContext): Response | Promise<Response> {
+    if (this.#onDeny) {
+      return this.#onDeny(reason, context)
+    }
+
+    return new Response(getDefaultErrorMessage(reason), { status: 403 })
+  }
+
+  #isRequestExempt(context: RequestContext): boolean {
+    for (let pattern of this.#insecureBypassPatterns) {
+      if (matchesBypassPattern(pattern, context)) {
+        return true
+      }
+    }
+
+    let requestOrigin = getHeaderValue(context.headers, 'Origin')
+    if (requestOrigin == null) {
+      return false
+    }
+
+    let normalizedOrigin = normalizeOrigin(requestOrigin)
+    return normalizedOrigin != null && this.#trustedOrigins.has(normalizedOrigin)
+  }
+}
+
+/**
+ * Creates middleware that rejects unsafe cross-origin requests.
+ *
+ * @param options Cross-origin protection options.
+ * @returns Middleware that validates request origin headers.
+ */
+export function cop(options: CopOptions = {}): Middleware {
+  let protection = new CrossOriginProtection(options)
+
+  return async (context, next) => {
+    let reason = protection.check(context)
+    if (reason == null) {
+      return next()
+    }
+
+    return protection.deny(reason, context)
+  }
+}
+
+function getDefaultErrorMessage(reason: CopFailureReason): string {
+  if (reason === 'cross-origin-request') {
+    return 'Forbidden: cross-origin request detected from Sec-Fetch-Site header'
+  }
+
+  return 'Forbidden: cross-origin request detected, and/or browser is out of date: Sec-Fetch-Site is missing, and Origin does not match Host'
+}
+
+function getHeaderValue(headers: Headers, name: string): string | null {
+  let value = headers.get(name)
+  if (value == null) {
+    return null
+  }
+
+  let trimmedValue = value.trim()
+  return trimmedValue === '' ? null : trimmedValue
+}
+
+function validateTrustedOrigin(origin: string): string {
+  let trimmedOrigin = origin.trim()
+  if (trimmedOrigin === '') {
+    throw new Error('trusted origin must not be empty')
+  }
+
+  if (trimmedOrigin.endsWith('/')) {
+    throw new Error(`invalid origin ${JSON.stringify(origin)}: trailing slash is not allowed`)
+  }
+
+  let parsedOrigin = parseOrigin(trimmedOrigin)
+  if (parsedOrigin == null) {
+    throw new Error(`invalid origin ${JSON.stringify(origin)}`)
+  }
+
+  if (parsedOrigin.pathname !== '/' || parsedOrigin.search !== '' || parsedOrigin.hash !== '') {
+    throw new Error(
+      `invalid origin ${JSON.stringify(origin)}: path, query, and fragment are not allowed`,
+    )
+  }
+
+  return serializeOrigin(parsedOrigin)
+}
+
+function normalizeOrigin(origin: string): string | null {
+  let parsedOrigin = parseOrigin(origin)
+  return parsedOrigin == null ? null : serializeOrigin(parsedOrigin)
+}
+
+function parseOrigin(origin: string): URL | null {
+  try {
+    let parsedOrigin = new URL(origin)
+    if (parsedOrigin.host === '') {
+      return null
+    }
+
+    if (parsedOrigin.username !== '' || parsedOrigin.password !== '') {
+      return null
+    }
+
+    return parsedOrigin
+  } catch {
+    return null
+  }
+}
+
+function serializeOrigin(origin: URL): string {
+  return `${origin.protocol}//${origin.host}`
+}
+
+function parseBypassPattern(pattern: string): BypassPattern {
+  let trimmedPattern = pattern.trim()
+  if (trimmedPattern === '') {
+    throw new Error('bypass pattern must not be empty')
+  }
+
+  let method: RequestMethod | null = null
+  let pathname = trimmedPattern
+  let methodPattern = /^([A-Z]+)\s+(.+)$/.exec(trimmedPattern)
+
+  if (methodPattern != null && methodPattern[2].startsWith('/')) {
+    let maybeMethod = methodPattern[1] as RequestMethod
+    if (!RequestMethods.includes(maybeMethod)) {
+      throw new Error(`invalid request method in bypass pattern ${JSON.stringify(pattern)}`)
+    }
+
+    method = maybeMethod
+    pathname = methodPattern[2]
+  }
+
+  if (!pathname.startsWith('/')) {
+    throw new Error(`invalid bypass pattern ${JSON.stringify(pattern)}: path must start with "/"`)
+  }
+
+  if (pathname.includes('?') || pathname.includes('#')) {
+    throw new Error(
+      `invalid bypass pattern ${JSON.stringify(pattern)}: query strings and fragments are not supported`,
+    )
+  }
+
+  let matchesSubtree = pathname.endsWith('/')
+  let normalizedPathname =
+    pathname.length > 1 && matchesSubtree ? pathname.slice(0, pathname.length - 1) : pathname
+  let rawSegments = normalizedPathname === '/' ? [] : normalizedPathname.slice(1).split('/')
+  let segments = rawSegments.map((segment, index) =>
+    parseBypassSegment(pattern, segment, index === rawSegments.length - 1),
+  )
+
+  return { method, pathname, segments, matchesSubtree }
+}
+
+function parseBypassSegment(
+  pattern: string,
+  segment: string,
+  isLastSegment: boolean,
+): BypassSegment {
+  if (segment === '') {
+    throw new Error(
+      `invalid bypass pattern ${JSON.stringify(pattern)}: empty path segments are not allowed`,
+    )
+  }
+
+  if (!segment.startsWith('{') || !segment.endsWith('}')) {
+    return { type: 'static', value: segment }
+  }
+
+  let wildcardName = segment.slice(1, segment.length - 1)
+  if (wildcardName === '') {
+    throw new Error(
+      `invalid bypass pattern ${JSON.stringify(pattern)}: empty wildcards are not allowed`,
+    )
+  }
+
+  if (wildcardName === '$') {
+    throw new Error(
+      `invalid bypass pattern ${JSON.stringify(pattern)}: "{$}" is not supported in cop-middleware`,
+    )
+  }
+
+  if (wildcardName.endsWith('...')) {
+    if (!isLastSegment) {
+      throw new Error(
+        `invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards must be last`,
+      )
+    }
+
+    if (wildcardName.length === 3) {
+      throw new Error(
+        `invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards require a name`,
+      )
+    }
+
+    return { type: 'rest' }
+  }
+
+  return { type: 'wildcard' }
+}
+
+function matchesBypassPattern(pattern: BypassPattern, context: RequestContext): boolean {
+  if (pattern.method != null && pattern.method !== context.method) {
+    return false
+  }
+
+  let pathname = context.url.pathname
+  let hasTrailingSlash = pathname.length > 1 && pathname.endsWith('/')
+  let normalizedPathname =
+    pathname.length > 1 && hasTrailingSlash ? pathname.slice(0, pathname.length - 1) : pathname
+  let pathSegments = normalizedPathname === '/' ? [] : normalizedPathname.slice(1).split('/')
+
+  let segmentIndex = 0
+  while (segmentIndex < pattern.segments.length) {
+    let pathSegment = pathSegments[segmentIndex]
+    let segment = pattern.segments[segmentIndex]
+
+    if (segment.type === 'rest') {
+      return true
+    }
+
+    if (pathSegment == null) {
+      return false
+    }
+
+    if (segment.type === 'static' && segment.value !== pathSegment) {
+      return false
+    }
+
+    segmentIndex++
+  }
+
+  if (pattern.matchesSubtree) {
+    if (pathSegments.length === pattern.segments.length) {
+      return pattern.pathname === '/' || hasTrailingSlash
+    }
+
+    return pathSegments.length > pattern.segments.length
+  }
+
+  return pathSegments.length === pattern.segments.length && !hasTrailingSlash
+}