[BUG] v1.7.3 breaks reverse proxies that change Host

[FiloSottile]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

If a same-origin request for example.com comes in with a valid token, and is then reverse proxied to backend.acme.example, it will be rejected by the new Origin header check, because the Host header was rewritten by the reverse proxy.

csrf/csrf.go

Lines 275 to 277 in 9dd6af1

	if requestURL.Host == "" {
	requestURL.Host = r.Host
	}

csrf/csrf.go

Lines 288 to 292 in 9dd6af1

	if !sameOrigin(&requestURL, parsedOrigin) && !slices.Contains(cs.opts.TrustedOrigins, parsedOrigin.Host) {
	r = envError(r, ErrBadOrigin)
	cs.opts.ErrorHandler.ServeHTTP(w, r)
	return
	}

Expected Behavior

Same-origin requests should be allowed even if the Host header is modified.

They can be reliably detected with the Sec-Fetch-Site header.

Steps To Reproduce

N/A

Anything else?

N/A