headroomlabs-ai/headroom · error · HTTPException

Not Found

Error message

Not Found

What it means

Error "Not Found" thrown in headroomlabs-ai/headroom.

Source

Thrown at headroom/proxy/loopback_guard.py:203

       who actually reaches the listener from outside ``127.0.0.0/8``
       / ``::1``.
    2. The inbound ``Host:`` header must also name loopback. Stops
       DNS-rebinding attacks where a browser sends requests to the
       loopback IP but the page origin is ``attacker.com`` — the IP
       check alone passes, but the ``Host:`` header still reads
       ``attacker.com`` and we reject the request here.

    Returning 404 (not 403) keeps debug endpoints invisible to
    external scanners — indistinguishable from "no such route".
    """
    if HTTPException is None:  # pragma: no cover - defensive
        raise RuntimeError("FastAPI is required for the loopback guard")

    client = getattr(request, "client", None)
    host = getattr(client, "host", None) if client is not None else None
    if not is_loopback_host(host):
        # No body: minimal FastAPI default, behaves like "no route".
        raise HTTPException(status_code=404)

    headers = getattr(request, "headers", None)
    if headers is None:
        # Manual ``Request`` stub with no ``headers`` attribute — used
        # by older unit tests that pre-date this gate. Treat the same
        # way as the IP-only path did and accept.
        return
    try:
        host_header = headers.get("host")
    except AttributeError:
        host_header = None
    if not is_loopback_host_header(host_header):
        raise HTTPException(status_code=404)


def require_same_origin(request: Request) -> None:  # type: ignore[valid-type]
    """FastAPI dependency: reject cross-origin browser requests on mutating routes.

View on GitHub (pinned to 322425c43b)

Solutions

1. Verify the request path matches a route the proxy actually serves
2. If you expected a dashboard/loopback route, check it is enabled and you are hitting the right port
3. Check proxy logs for the registered routes

When it happens

Trigger: Returned by the loopback guard when a request targets a path that is not served, responding 404 Not Found.

Common situations: See trigger scenarios.

AI-assisted analysis of headroomlabs-ai/headroom@322425c43b (2026-08-15). Data as JSON: /api/errors/75e8e23a4c827662. Report an issue: GitHub.