import { IncomingMessage, ServerResponse } from 'http';
export interface OriginValidationConfig {
    allowedOrigins?: string[];
}
/**
 * Validates the Origin header on incoming requests.
 * Returns true if the request should be allowed, false if rejected.
 * When rejecting, sends a 403 response.
 */
export declare function validateOrigin(req: IncomingMessage, res: ServerResponse, config: OriginValidationConfig): boolean;
/**
 * Returns the validated origin for use in CORS headers, or '*' if no validation configured.
 */
export declare function getValidatedCorsOrigin(req: IncomingMessage, config: OriginValidationConfig): string;