diff --git a/platform/platform-impl/src/org/jetbrains/ide/HttpRequestHandler.java b/platform/platform-impl/src/org/jetbrains/ide/HttpRequestHandler.java
index 23730cbad529..0f03b280d8c3 100644
--- a/platform/platform-impl/src/org/jetbrains/ide/HttpRequestHandler.java
+++ b/platform/platform-impl/src/org/jetbrains/ide/HttpRequestHandler.java
@@ -43,8 +43,12 @@ public abstract class HttpRequestHandler {
     return false;
   }
 
+  @SuppressWarnings("SpellCheckingInspection")
   public boolean isAccessible(@NotNull HttpRequest request) {
-    return NettyKt.isLocalOrigin(request);
+    String host = NettyKt.getHost(request);
+    // If attacker.com DNS rebound to 127.0.0.1 and user open site directly — no Origin or Referer headers.
+    // So we should check Host header.
+    return host != null && NettyKt.isLocalOrigin(request) && NettyKt.parseAndCheckIsLocalHost(host);
   }
 
   public boolean isSupported(@NotNull FullHttpRequest request) {
diff --git a/platform/platform-impl/src/org/jetbrains/io/netty.kt b/platform/platform-impl/src/org/jetbrains/io/netty.kt
index c46eceb88541..336205bd7cb8 100644
--- a/platform/platform-impl/src/org/jetbrains/io/netty.kt
+++ b/platform/platform-impl/src/org/jetbrains/io/netty.kt
@@ -153,7 +153,8 @@ private fun isTrustedChromeExtension(uri: URI): Boolean {
   return uri.scheme == "chrome-extension" && (uri.host == "hmhgeddbohgjknpmjagkdomcpobmllji" || uri.host == "offnedcbhjldheanlbojaefbfbllddna")
 }
 
-private fun parseAndCheckIsLocalHost(uri: String?, onlyAnyOrLoopback: Boolean): Boolean {
+@JvmOverloads
+fun parseAndCheckIsLocalHost(uri: String?, onlyAnyOrLoopback: Boolean = true): Boolean {
   if (uri == null) {
     return true
   }