fix: enable DNS rebinding protection by default#659

Open

devcrocod wants to merge 3 commits intomainfrom

devcrocod/dns-rebinding-protection

Commits on Mar 30, 2026

fix: enable DNS rebinding protection by default via Ktor route-scoped plugin
devcrocod
committed
refactor: make `LOCALHOST_ALLOWED_HOSTS` internal to limit API exposure
devcrocod
committed

Commits on Mar 31, 2026

replace URLBuilder-based host parsing with strict Host header parser
devcrocod
committed