Reject ambiguous HTTP authorities and request targets

[EauDoon]

Summary

• Require exactly one Host header containing only the active loopback authority.
• Reject user information, paths, queries, and fragments in Host values.
• Require origin-form request targets before rate accounting or routing.
• Cover duplicate Host values and foreign absolute-form GET and POST targets with raw-socket regressions.
• Prove rejected targets cannot mutate action state or consume the rate budget.

Tests

• npm run check (137 tests)
• Focused HTTP authority regressions (2 tests)
• Public-tree scanner: no finding delta

---

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟨 Empty Host delimiters bypass validation

hostUrl accepts empty user-info, query, and fragment delimiters because URL normalization erases them. Ambiguous Host values can reach every route.

(Refers to this code)

---

Was this helpful? React with 👍 or 👎 to provide feedback.