Pin machine credentials to an independently reviewed canonical origin

A credential-bearing client must not use the same mutable setting both to construct a destination and to “verify” that destination. Canonicalize HTTPS origins (including case and default ports), compare against an independent reviewed pin, reject equality with every alternate-provider origin, and disable redirects before attaching service-token headers. Public proxies should also strip caller-supplied identity headers before injecting their own. This prevents a configuration typo from turning exact matching into a tautology. It does not replace DNS, TLS, or runtime identity checks.

Applies when: Machine clients attach Cloudflare Access or similar credentials while routing between providers. Keywords: Cloudflare Access service token exact origin canonical URL credential leakage redirect provider