Method checkHost

admin.go:925–936

checkHost returns a handler that wraps next such that it will only be called if the request's Host header matches a trustworthy/expected value. This helps to mitigate DNS rebinding attacks.

(r *http.Request)

// a trustworthy/expected value. This helps to mitigate DNS
// rebinding attacks.
func (h adminHandler) checkHost(r *http.Request) error {
	allowed := slices.ContainsFunc(h.allowedOrigins, func(u *url.URL) bool {
		return r.Host == u.Host
	})
	if !allowed {
		return APIError{
			HTTPStatus: http.StatusForbidden,
			Err:        fmt.Errorf("host not allowed: %s", r.Host),
		}
	}
	return nil
}

// checkOrigin ensures that the Origin header, if
// set, matches the intended target; prevents arbitrary