Module security 

Who may talk to the host. Loopback is not access control: any local process and any web page can reach 127.0.0.1. So:

• every /api request carries the per-start token as a bearer header — never in a URL, which ends up in logs and history;
• the Host header must name the loopback address and this port, so a page on another site whose name resolves to 127.0.0.1 (DNS rebinding) is refused;
• a request that changes anything must come from this origin;
• the interface is served with a policy that lets it load and send to this host only, and never be framed.

Constants

CONTENT_SECURITY_POLICY

What the page may load and where it may send: this host and nothing else.

Functions

authorised

The bearer token is the host’s.

host_ok

The Host header names this host (DNS rebinding defence).

hosts

The names this host answers to.

origin_ok

A request that changes something comes from this origin: browsers send Origin on every non-GET fetch, so a cross-site form or script is refused even if it guessed the token.

token

A fresh token: 32 random bytes, hex.