Refuse odd requests from other sites

How to do it

In middleware, allow requests with no Sec-Fetch-Site, or with same-origin, same-site or none. Also allow cross-site GET navigations, except into object or embed. Answer 403 to the rest. Exempt public APIs and files meant for other sites.

Example

function fetchMetadata(req, res, next) {
  const site = req.get('Sec-Fetch-Site');
  if (!site || ['same-origin', 'same-site', 'none'].includes(site)) return next();
  const dest = req.get('Sec-Fetch-Dest');
  if (req.method === 'GET' && req.get('Sec-Fetch-Mode') === 'navigate' && dest !== 'object' && dest !== 'embed') return next();
  res.status(403).end();
}

How to check

A cross-site fetch to a page fails with 403. A normal link still works.