But can’t any JavaScript in the browser can call back to 127.0.0.1 (within the bounds of cross-origin policy). So you have to check Origin/Referer at least I t

But can’t any JavaScript in the browser can call back to 127.0.0.1 (within the bounds of cross-origin policy). So you have to check Origin/Referer at least I think. Can you be sure Origin/Referer isn’t spoofed? Then there’s DNS rebinding which can get around the SOP. What about maybe strange ways that malformed requests could end up being reflected back to 127.0.0.1 through rebinding? So it just seems to me that even binding to 127.0.0.1 you have to be ready for just about anything to come in on the socket.