This is a very interesting thread. It feels like on that thread SSH was being used (instead of HTTP as in here) and enforce_origin does not (yet?) work on SSH.
It’s possible enforce_origin will never work on SSH (and if it should not, Caddy should reject that configuration) - but should we discuss this there or should I open a new thread?