The Origin rule of every HTTP surface of the runtime: protection against DNS rebinding and cross-site WebSocket hijacking.

A request without an Origin header (a native client) passes. One with exactly one value passes when that value is a loopback origin or is listed in the allowed origins; anything else, several values included, is refused.