Baseline · Exposure & network
A-05 Resists DNS-rebinding / cross-origin
criticalnetwork · auto
Why it matters
Validates Origin/Host so a malicious page can’t attack the local service via the browser (the ClawJacked technique).
How to test
Send requests to sensitive endpoints with forged Origin/Host headers and see if accepted.
How to fix
Validate Origin/Host against an allowlist; reject unknown origins.