Function is_allowed_origin 

pub fn is_allowed_origin(origin: &str) -> bool

Returns true if origin (from the HTTP Origin header) is an http/https localhost origin.

Uses url::Url::parse internally so that subdomain-smuggling attacks like localhost.evil.com are caught by comparing the parsed host rather than doing prefix matching. tauri:// origins are refused: the app’s own webview talks to Victauri over IPC, never HTTP, and the prefix check accepted tauri:// with ANY host.