JOC Cockpit should check for Host Header Injection

Current Situation

Currently JOC Cockpit does not check if the value form the Host header of the request matches the host that is set in the origin header. That can result in a HTTP 301 and HTTP 302 status code depending on the client. In general, browsers will receive a HTTP 302 (temporary redirect) status code while more sophisticated REST Clients can receive a HTTP 301 (static redirect) status code.

The HTTP 301 and HTTP 302 responses contain a Location header with the host from the request's Host header that by default is automatically used by browsers to send a subsequent HTTP GET request to the address of the response Location header. For most REST APIs this is not exploitable, because most APIs respond to HTTP POST requests only.

Desired Behavior

JOC-Cockpit should check by default if any request contains a host-origin mismatch and should decline the request.