/** Next's internal request URL may use its bind address behind a reverse proxy. */
export function clockOriginAllowed(headers:Headers) {
  try {
    const origin=headers.get('origin');
    if(!origin)return false;
    const url=new URL(origin);
    return ['http:','https:'].includes(url.protocol) && url.host===headers.get('host');
  }catch{return false;}
}