Function origin_and_security_headers 

pub async fn origin_and_security_headers(
    __arg0: State<AppState>,
    request: Request<Body>,
    next: Next,
) -> Response

Reject cross-site state-changing browser requests and protect public Demo/private API responses.

Demo mode requires the exact configured Origin on every state-changing request. Full mode retains CLI/curl compatibility, accepts a browser-controlled same-origin request from the Vite development proxy when no explicit origin pin is configured, and otherwise requires either the explicitly configured Origin or an automatic same-host match. This middleware never emits CORS response headers.

Baseline browser protections apply to every response. Demo responses additionally receive private/no-index caching headers on every path, including the embedded SPA; Full mode receives those privacy headers on /api only so immutable static-asset caching is preserved. Full mode’s existing Scalar documentation page is the sole CSP exception because its upstream HTML loads the Scalar bundle from jsDelivr; Demo mode does not expose that page.