code: func (wfe *WebFrontEndImpl) validPOSTURL(
  	request *http.Request,
  	jws *jose.JSONWebSignature) *probs.ProblemDetails {
  	// validPOSTURL is called after parseJWS() which defends against the incorrect
  	// number of signatures.
  	header := jws.Signatures[0].Header
  	extraHeaders := header.ExtraHeaders
  	// Check that there is at least one Extra Header
  	if len(extraHeaders) == 0 {
  		wfe.stats.joseErrorCount.With(prometheus.Labels{"type": "JWSNoExtraHeaders"}).Inc()
  		return probs.Malformed("JWS header parameter 'url' required")
  	}
  	// Try to read a 'url' Extra Header as a string
  	headerURL, ok := extraHeaders[jose.HeaderKey("url")].(string)
  	if !ok || len(headerURL) == 0 {
  		wfe.stats.joseErrorCount.With(prometheus.Labels{"type": "JWSMissingURL"}).Inc()
  		return probs.Malformed("JWS header parameter 'url' required")
  	}
  	// Compute the URL we expect to be in the JWS based on the HTTP request
  	expectedURL := url.URL{
  		Scheme: requestProto(request),
  		Host:   request.Host,
  		Path:   request.RequestURI,
  	}
  	// Check that the URL we expect is the one that was found in the signed JWS
  	// header
  	if expectedURL.String() != headerURL {
  		wfe.stats.joseErrorCount.With(prometheus.Labels{"type": "JWSMismatchedURL"}).Inc()
  		return probs.Malformed("JWS header parameter 'url' incorrect. Expected %q got %q",
  			expectedURL.String(), headerURL)
  	}
  	return nil
  }
docs: // validPOSTURL checks the JWS' URL header against the expected URL based on the
  // HTTP request. This prevents a JWS intended for one endpoint being replayed
  // against a different endpoint. If the URL isn't present, is invalid, or
  // doesn't match the HTTP request a problem is returned.