/**
 * Browser Origin checking for CSRF protection on HTTP and WebSocket requests.
 *
 * Validates that browser-initiated requests come from an allowed origin.
 * Non-browser requests (no Origin header) are handled by other auth layers.
 */
type OriginCheckResult = {
    ok: true;
    matchedBy: 'allowlist' | 'host-header-fallback' | 'local-loopback' | 'trusted-proxy-same-host';
} | {
    ok: false;
    reason: string;
};
export declare function checkBrowserOrigin(params: {
    requestHost?: string;
    origin?: string;
    allowedOrigins?: string[];
    allowHostHeaderOriginFallback?: boolean;
    isLocalClient?: boolean;
    /**
     * When true, allow `Origin` whose host portion exactly equals the `Host`
     * header. Only flip this on after verifying the TCP source is loopback or
     * inside `gateway.trustedProxies` — otherwise an attacker who can set
     * arbitrary Origin + Host (e.g. via an open SSRF) bypasses CSRF.
     * Enables zero-config reverse-proxy access at the user's own domain.
     */
    autoAllowSameHostFromTrustedProxy?: boolean;
}): OriginCheckResult;
export {};