---
title: "MGS9007: host not allowed"
description: The server refused a request whose Host or Origin header names a host it does not serve. This is the DNS-rebinding guard.
tags: [MGS9007, auth, rebind, host, origin, cors, "403"]
---

# MGS9007: host not allowed

The server answered `403 forbidden` because the request's `Host` header, or its
`Origin` header when one was sent, named a host the server does not serve.

```text
[MGS9007] the server serves only loopback hosts and the configured console
origin; this request named another host in its Host or Origin header
  see: .../MGS9007.md
```

## Why

The server listens on loopback, but a web page on any site can point a DNS name
at `127.0.0.1` and have the browser send requests to it (DNS rebinding). Those
requests carry the attacker's hostname in `Host` and `Origin`, so the server
accepts only loopback addresses, `localhost`, and the hosted console's origin.

## Resolution

- Reach the server as `127.0.0.1:<port>` or `localhost:<port>`, not through
  another hostname that resolves to this machine.
- A browser client on another origin: open the console from the server itself
  (`magus console`), or from the hosted console the server already trusts.

## What this is NOT

- **Not a token problem.** The host check runs before the bearer check; a
  missing or wrong token is [MGS9001](MGS9001.md).