Language: JavaScript
Label: safe
CWE: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.

Code:
		allowRequest: (req, callback) => {
			authorize(req, (err) => {
				if (err) {
					return callback(err);
				}
				const csrf = require('../middleware/csrf');
				const isValid = csrf.isRequestValid({
					session: req.session || {},
					query: req._query,
					headers: req.headers,
				});
				callback(null, isValid);
			});
		},
	};
	/*
	 * Restrict socket.io listener to cookie domain. If none is set, infer based on url.
	 * Production only so you don't get accidentally locked out.
	 * Can be overridden via config (socket.io:origins)
	 */
	if (process.env.NODE_ENV !== 'development' || nconf.get('socket.io:cors')) {
		const origins = nconf.get('socket.io:origins');
		opts.cors = nconf.get('socket.io:cors') || {
			origin: origins,
			methods: ['GET', 'POST'],
			allowedHeaders: ['content-type'],
		};
		winston.info(`[socket.io] Restricting access to origin: ${origins}`);
	}

	io.listen(server, opts);
	Sockets.server = io;
};