What?

Make Server Actions CSRF origin validation case-insensitive for both:

1. Host / X-Forwarded-Host header comparison with Origin
2. serverActions.allowedOrigins config matching

Why?

Per RFC 3986 Section 3.2.2 states the host component of URIs is case-insensitive:

"...host is case-insensitive, producers and normalizers should use lowercase for registered names..."

Per RFC 3986 Section 6.2.2.1 reinforces:

"...the scheme and host are case-insensitive and therefore should be normalized to lowercase."

(per RFC 2119) While the RFC recommends ("should") that producers normalize to lowercase, this is not mandatory. In practice, proxies may preserve the original case of Host/X-Forwarded-Host headers. Since upstream normalization is not guaranteed, the application(Next.js) performing the comparison must handle case-insensitive matching.

Current behavior in the existing code

In the current implementation, normalization via the JavaScript URL API is applied only to the Origin header value. Meanwhile, Host/X-Forwarded-Host headers retain their original casing, which can lead to false-positive CSRF blocks when proxies forward headers with different casing (e.g., Example.com vs example.com).

How?

• Normalize Host and X-Forwarded-Host to lowercase in parseHostHeader()
• Add defensive case-insensitive comparison in origin/host matching helper
• (Additional) Normalize both origin and patterns to lowercase in isCsrfOriginAllowed()
  • Similar to the Origin vs Host casing mismatch, this also fixes case mismatches in serverActions.allowedOrigins values from next.config.js.

Tests

1. E2E test for Host/X-Forwarded-Host case mismatch (host-origin-case-insensitive)

To reproduce the real-world scenario where Origin and X-Forwarded-Host have different casing, added a proxy-based e2e test. The proxy sets:

• Origin: https://example.com (lowercase, as normalized by URL API)
• X-Forwarded-Host: Example.com (mixed case, simulating proxy behavior)

This test failed before the fix due to case-sensitive comparison, now passes.

2. E2E test for allowedOrigins config case mismatch (config-match-case-insensitive)

Added an e2e test where next.config.js specifies serverActions.allowedOrigins: ['Example.COM'] while the actual origin header is https://example.com. This verifies that the config matching is also case-insensitive.

3. Unit tests

• action-handler.test.ts: Tests for parseHostHeader() lowercasing and isOriginMatchingHost() case-insensitive comparison
• csrf-protection.test.ts: Tests for isCsrfOriginAllowed() case-insensitive matching between origin and allowedOrigins patterns

To reproduce (before the fix)

You can confirm the previous behavior (case-sensitive matching) by checking out the commits below and running the corresponding e2e tests.

1) Origin vs Host / X-Forwarded-Host case mismatch (e2b569a)

 GET / 200 in 394ms (compile: 103ms, proxy.ts: 113ms, render: 178ms)
`x-forwarded-host` header with value `Example.com` does not match `origin` header with value `example.com` from a forwarded Server Actions request. Aborting the action.
⨯ Error: Invalid Server Actions request.
    at ignore-listed frames {
  digest: '1743102819@E80'
}
 POST / 500 in 171ms (compile: 2ms, proxy.ts: 3ms, render: 166ms)
[browser] Uncaught Error: Invalid Server Actions request.

git checkout e2b569a
pnpm test-dev-turbo test/e2e/app-dir/actions-allowed-origins/app-action-host-match-case-insensitive.test.ts

2) serverActions.allowedOrigins config case mismatch (a2d6510)

 GET / 200 in 606ms (compile: 280ms, proxy.ts: 124ms, render: 202ms)
`x-forwarded-host` header with value `localhost:3000` does not match `origin` header with value `example.com` from a forwarded Server Actions request. Aborting the action.
⨯ Error: Invalid Server Actions request.
    at ignore-listed frames {
  digest: '3375356869@E80'
}
 POST / 500 in 201ms (compile: 4ms, proxy.ts: 3ms, render: 193ms)
[browser] Uncaught Error: Invalid Server Actions request.

git checkout a2d6510
pnpm test-dev-turbo test/e2e/app-dir/actions-allowed-origins/app-action-config-match-case-insensitive.test.ts

Fixes #issue