export async function execRequest(routes: Routers, ctx: AppContext) {
	const match = findMatchingRoute(ctx.path, routes);
	if (!match) throw new ErrorNotFound();

	const endPoint = match.route.findEndPoint(ctx.request.method as HttpMethod, match.subPath.schema);
	if (ctx.URL && !isValidOrigin(ctx.URL.origin, baseUrl(endPoint.type), endPoint.type)) throw new ErrorNotFound(`Invalid origin: ${ctx.URL.origin}`, 'invalidOrigin');

	const isPublicRoute = match.route.isPublic(match.subPath.schema);

	// This is a generic catch-all for all private end points - if we
	// couldn't get a valid session, we exit now. Individual end points
	// might have additional permission checks depending on the action.
	if (!isPublicRoute && !ctx.joplin.owner) throw new ErrorForbidden();

	await csrfCheck(ctx, isPublicRoute);

	return endPoint.handler(match.subPath, ctx);
}
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.