A canonical origin is the single server-defined base URL an application should trust for security-sensitive links, redirects, and callback URLs. It is the “official” origin for the site, usually set in configuration rather than derived from request data such as the Host header, :authority, or user input.
This matters because many attacks begin when an app builds absolute URLs from values the client can change. If an attacker can influence the origin, they may poison password-reset links, OAuth callbacks, notification links, or other outbound references. Defenders use a canonical origin to keep those flows stable: the application should generate URLs from a fixed allowlisted base, not from whatever host the request claims. In practice, this reduces the impact of host header injection and helps prevent redirect or link manipulation from becoming a phishing or account-takeover path.