The DNS-rebind check is not triggering when no hostname is supplied.

[Sanderluc5]

Describe the bug

It seems that the DNS-rebinding option is not working correctly when no hostname has been supplied. I have set my DNS-rebinding to the host xxx.mydomain.com but visiting from my WAN-ip I can still access the OPNSense-GUI. Visiting from other domains seems to still trigger the DNS-rebinding.

I'm 100% sure this issue was not existing in a previous version of OPNSense.

To Reproduce

Steps to reproduce the behavior:

• Enable DNS-rebinding.
• Visit your Router from the IP-directly without supplying a hostname.
• DNS-rebinding has been bypassed successfully.

Expected behavior

That DNS-rebinding also works when a user did not supply any hostname.

Software version used and hardware type if relevant, e.g.:

OPNsense 24.7.11_2-amd64

[OPNsense-bot]

Thank you for creating an issue.
Since the ticket doesn't seem to be using one of our templates, we're marking this issue as low priority until further notice.

For more information about the policies for this repository,
please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

The easiest option to gain traction is to close this ticket and open a new one using one of our templates.

[AdSchellevis]

These parts haven't been changed in over 2 years, looking at the code, it seems to be doing what it should (ignore ip addresses when validating for hostnames).

core/src/www/authgui.inc

Lines 96 to 97 in 752795a

	if (is_ipaddr($http_host) || in_array($_SERVER['SERVER_ADDR'], ["127.0.0.1", "::1"])) {
	return false;