app/extend/application.js
function securityAssert(ctx) {
      // all disabled. don't need check
      if (!csrfEnable && !validateReferrer) return;

      // pass referrer check
      const referrer = ctx.get('referrer');
      if (validateReferrer && validateReferrer(referrer)) return;
      if (csrfEnable && validateCsrf(ctx)) return;

      const err = new Error('jsonp request security validate failed');
      err.referrer = referrer;
      err.status = 403;
      throw err;
    }
function securityAssert(ctx) {
      // all disabled. don't need check
      if (!csrfEnable && !validateReferrer) return;

      // pass referrer check
      const referrer = ctx.get('referrer');
      if (validateReferrer && validateReferrer(referrer)) return;
      if (csrfEnable && validateCsrf(ctx)) return;

      const err = new Error('jsonp request security validate failed');
      err.referrer = referrer;
      err.status = 403;
      throw err;
    }
function securityAssert ( ctx ) { // all disabled. don't need check if ( ! csrfEnable && ! validateReferrer ) return ; // pass referrer check const referrer = ctx . get ( 'referrer' ) ; if ( validateReferrer && validateReferrer ( referrer ) ) return ; if ( csrfEnable && validateCsrf ( ctx ) ) return ; const err = new Error ( 'jsonp request security validate failed' ) ; err . referrer = referrer ; err . status = 403 ; throw err ; }
jsonp request security check, pass if

1. hit referrer white list
2. or pass csrf check
3. both check are disabled

@param  {Context} ctx request context
jsonp request security check pass if