Function is_loopback_origin 

fn is_loopback_origin(origin: &str) -> bool

Whether origin is a page served on the user’s own machine: an http or https origin whose host is loopback, at any port, in every build.

The host is read from a parsed URI, never matched as a substring: a host that merely contains a loopback name, like localhost.evil.com, is its own host and stays refused. The authority must be a host and an optional numeric port exactly, because http’s own host() stops at the first ] and would read [::1].evil.com as [::1].