# `ExMCP.Plugs.DnsRebinding`
[🔗](https://github.com/azmaveth/ex_mcp/blob/v1.0.0/lib/ex_mcp/plugs/dns_rebinding.ex#L1)

Plug for DNS rebinding protection.

Validates that the request `Host` header is in an allow-list of expected
hostnames, rejecting requests whose Host points anywhere else. This
prevents DNS rebinding attacks where a malicious website resolves its own
domain to a loopback address so the victim's browser sends requests to a
local MCP server.

Ports are ignored when comparing hosts, and bracketed IPv6 forms such as
`"[::1]:8080"` match both `"[::1]"` and `"::1"` allow-list entries.

By default only localhost names are allowed. `"0.0.0.0"` is deliberately
not in the defaults: it is a bind address, not a name legitimate clients
send in a Host header.

## Usage

    plug ExMCP.Plugs.DnsRebinding

Or with custom allowed hosts:

    plug ExMCP.Plugs.DnsRebinding, allowed_hosts: ["localhost", "myhost.local"]

---

*Consult [api-reference.md](api-reference.md) for complete listing*