add default server block to drop unknown host headers

tests/test_default_server.py

@@ -0,0 +1,29 @@
+"""Test that unknown Host headers are dropped by the default server block."""
+
+import socket
+import ssl
+
+import pytest
+
+
+HOST = "www.hantim.net"
+
+
+def test_unknown_host_https_dropped():
+    """HTTPS request with a fake Host header should be dropped (connection reset)."""
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    ctx.check_hostname = False
+    ctx.verify_mode = ssl.CERT_NONE
+    sock = socket.create_connection((HOST, 443))
+    ssock = ctx.wrap_socket(sock, server_hostname=HOST)
+    ssock.sendall(b"GET / HTTP/1.1\r\nHost: evil.example.com\r\n\r\n")
+    resp = ssock.recv(4096)
+    assert resp == b"", f"Expected empty response, got {resp[:100]}"
+
+
+def test_unknown_host_http_dropped():
+    """HTTP request with a fake Host header should be dropped (connection reset)."""
+    sock = socket.create_connection((HOST, 80))
+    sock.sendall(b"GET / HTTP/1.1\r\nHost: evil.example.com\r\n\r\n")
+    resp = sock.recv(4096)
+    assert resp == b"", f"Expected empty response, got {resp[:100]}"