Function host_is_this_server

src/ui/http_server.c:1688–1695

True when the Host header names the loopback interface and exact port the * server binds to. Anything else means the request reached us under a * name that is not loopback — a rebinding DNS host or a proxy pointed at the * local port — which is the DNS-rebinding / cross-site vector against a * localhost-only service. */

 * local port — which is the DNS-rebinding / cross-site vector against a
 * localhost-only service. */
static bool host_is_this_server(const char *host, int port) {
    char expected[128];
    int length = snprintf(expected, sizeof(expected), "127.0.0.1:%d", port);
    if (length > 0 && (size_t)length < sizeof(expected) && strcmp(host, expected) == 0)
        return true;
    length = snprintf(expected, sizeof(expected), "localhost:%d", port);
    return length > 0 && (size_t)length < sizeof(expected) && strcmp(host, expected) == 0;
}

static bool route_is_protected(const char *path) {
    return strcmp(path, "/api") == 0 || strncmp(path, "/api/", 5) == 0 || strcmp(path, "/rpc") == 0;