Plug for DNS rebinding protection.
Validates that the request Host header is in an allow-list of expected
hostnames, rejecting requests whose Host points anywhere else. This
prevents DNS rebinding attacks where a malicious website resolves its own
domain to a loopback address so the victim's browser sends requests to a
local MCP server.
Ports are ignored when comparing hosts, and bracketed IPv6 forms such as
"[::1]:8080" match both "[::1]" and "::1" allow-list entries.
By default only localhost names are allowed. "0.0.0.0" is deliberately
not in the defaults: it is a bind address, not a name legitimate clients
send in a Host header.
Usage
plug ExMCP.Plugs.DnsRebindingOr with custom allowed hosts:
plug ExMCP.Plugs.DnsRebinding, allowed_hosts: ["localhost", "myhost.local"]