The dashboard sends Referrer-Policy: no-referrer, and Chromium's behavior
on a same-origin form submit from such a page is to send Origin: null.
isSameOriginPost() fed "null" to new URL(), which throws → false → 400
"bad request" for every Chromium user typing the correct password.
Treat a null Origin like an absent one: it is an unattributed origin, not
a foreign one — curl (no Origin at all) was always allowed, the login POST
carries no session to ride, and the password is the credential. Real
foreign origins stay rejected.
The regression net now posts the way Chromium actually does: the
smoke-auth sign-in and logout carry Origin: null, and cross-origin logout
gets its own rejection case (54 → 56 assertions). The suites missed this
because every passing login came from curl or Node fetch — neither sends
an Origin header — while render-check injects its cookie past the form.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Colby McHenry
3cb774a5cd