Function is_loopback_origin 

pub(crate) fn is_loopback_origin(origin: &str) -> bool

http://127.0.0.1 or http://localhost, optionally with a numeric port: where the desktop frontend is served from (the CEF host’s loopback server, or the Vite dev server). A headless srv behind a reverse proxy can also accept the proxy’s origin; see is_allowed_origin, which CORS and ws_origin_guard use.