chore(backend): implement origin validation for WebSocket connections

[Im-Madhur-Gupta]

This PR is to be merged ONLY if the security team detects abuse of the backend as it currently does not have CORS protection live, this was done after an agreement that allowing users to connect to backend directly and receive raw event payloads would be a good practice as this is an example app.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
monode	Ready	Preview, Comment	Jan 27, 2026 5:19pm

[0xflashboy]

Suggested change

	match origin {
	Some(o) if o == ALLOWED_ORIGIN => {
	info!("Accepted connection from allowed origin: {}", o);
	Ok(response)
	}
	Some(o) => {
	warn!("Rejected connection from disallowed origin: {}", o);
	let error_response = WsResponse::builder()
	.status(hyper::StatusCode::FORBIDDEN)
	.body(None)
	.unwrap();
	Err(error_response)
	}
	None => {
	warn!("Rejected connection with no Origin header from {}", addr);
	let error_response = WsResponse::builder()
	.status(hyper::StatusCode::FORBIDDEN)
	.body(None)
	.unwrap();
	Err(error_response)
	}
	}
	match origin {
	Some(o) => {
	if o == ALLOWED_ORIGIN {
	info!("Accepted connection from allowed origin: {}", o);
	Ok(response)
	} else {
	warn!("Rejected connection from disallowed origin: {}", o);
	let error_response = WsResponse::builder()
	.status(hyper::StatusCode::FORBIDDEN)
	.body(None)
	.unwrap();
	Err(error_response)
	}
	}
	None => {
	warn!("Rejected connection with no Origin header from {}", addr);
	let error_response = WsResponse::builder()
	.status(hyper::StatusCode::FORBIDDEN)
	.body(None)
	.unwrap();
	Err(error_response)
	}
	}