rpc: prevent cross-origin calls with cached credentials #36464

Problem: If a browser has cached Bitcoin Core RPC credentials, another page permitted to reach RPC may be able to invoke methods using them. The calls can execute even when the page cannot read the response.

Browser RPC examples I found: Block Clock, transaction broadcasting.

Fix: Reject browser-origin RPC requests before authentication.

Note that this rejects every Origin value, including same-origin requests, null, and empty values. Browser or reverse-proxy integrations that add this header will need to adapt.

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--006a51241073e994b41acfe9ec718e94-->

External sites

• Code coverage & benchmarks: https://corecheck.dev/bitcoin/bitcoin/pulls/36464
• Ralph review <img src=https://review.fish.foo/assets/bitcoin/bitcoin/36464.png alt="Ralph review status"> https://git.fish.foo/bitcoin/bitcoin/pulls/36464#author-ralph

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline and AI policy for information on the review process.

If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

LLM Linter (✨ experimental)

Possible places where comparison-specific test macros should replace generic comparisons:

• test/functional/interface_http.py: assert response.getheader('WWW-Authenticate') is None → Prefer assert_equal(response.getheader('WWW-Authenticate'), None).

^{2026-10-08 05:52:10}

concept ACK