Move server.name validation before �uthenticateRequest.

Author: m0ver

src/main/java/org/tinystruct/system/TomcatServer.java

@@ -342,6 +342,26 @@ public void service(HttpServletRequest request, HttpServletResponse response) th
             Request<HttpServletRequest, ServletInputStream> _request = new RequestBuilder(request, isSSL());
             Response<HttpServletResponse, ServletOutputStream> _response = new ResponseBuilder(response);
 
+            // Enforce server name restriction if configured
+            String configuredServerName = settings.get("server.name");
+            if (configuredServerName != null && !configuredServerName.trim().isEmpty()) {
+                String hostHeader = request.getHeader("Host");
+                boolean hostAllowed = false;
+                if (hostHeader != null) {
+                    for (String allowed : configuredServerName.split(",")) {
+                        if (hostHeader.equalsIgnoreCase(allowed.trim())) {
+                            hostAllowed = true;
+                            break;
+                        }
+                    }
+                }
+                if (!hostAllowed) {
+                    logger.warning("Rejected request: Host header '" + hostHeader + "' does not match any configured server.name '" + configuredServerName.trim() + "'");
+                    sendErrorResponse(request, response, 400, "Bad Request: Invalid server name.");
+                    return;
+                }
+            }
+
             // Authenticate request
             if (!authenticateRequest(_request, context)) {
                 sendErrorResponse(request, response, 401, "Invalid or expired token.");
@@ -424,26 +444,6 @@ public void service(HttpServletRequest request, HttpServletResponse response) th
                     return;
                 }
 
-                // Enforce server name restriction if configured
-                String configuredServerName = settings.get("server.name");
-                if (configuredServerName != null && !configuredServerName.trim().isEmpty()) {
-                    String hostHeader = request.getHeader("Host");
-                    boolean hostAllowed = false;
-                    if (hostHeader != null) {
-                        for (String allowed : configuredServerName.split(",")) {
-                            if (hostHeader.equalsIgnoreCase(allowed.trim())) {
-                                hostAllowed = true;
-                                break;
-                            }
-                        }
-                    }
-                    if (!hostAllowed) {
-                        logger.warning("Rejected request: Host header '" + hostHeader + "' does not match any configured server.name '" + configuredServerName.trim() + "'");
-                        sendErrorResponse(request, response, 400, "Bad Request: Invalid server name.");
-                        return;
-                    }
-                }
-
                 if (isSSE(request)) {
                     handleSSE(context, _request, _response);
                     return;