review, cso: a hand-built request cannot settle a header-derived gate

[EmilianoU26]

A server that gates state-changing requests on Origin, Referer or
Sec-Fetch-* reads a header set the browser DERIVES from policy, navigation
and form target. curl -H "Origin: ...", an HTTP client, an in-process test
client, or setting the header by hand all fabricate that set — a green result
there proves only what the author typed.

In the audit: ask what the gate does when Origin is absent or literally
null. Allowed is a CSRF bypass, because the check is decorative and an
attacker simply omits the header. Rejected breaks real sign-ins under a
known-bad pair — a Referrer-Policy: no-referrer response header plus an
Origin allowlist makes the browser send Origin: null on a same-origin form
POST. Both branches are findings; neither is "missing hardening". And since a
request tool cannot settle it, report UNVERIFIED with the browser check named
as the next step rather than discarding the finding when curl succeeds.

In review: a test that sets those headers by hand is not coverage for this
class — real coverage is browser-driven. Same for an account/identity switch
covered only by a clean-browser test: starting from no session proves nothing
about the transition.

cso/sections/audit-phases.md.tmpl is the edited source; the .md is
regenerated output. review/specialists/testing.md is hand-maintained.
Parity suite: 21/21.

Deliberately NOT added to the /qa surface, where this doctrine also belongs:
/qa sits at its parity cap against v1.64.1.0 (adding 318 characters takes the
size ratio to 1.084 against a 1.08 maximum), so landing it there needs a trade
against existing /qa content — a maintainer's call, not something to smuggle
in by trimming someone else's paragraph.

🤖 Generated with Claude Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here