DNS rebinding vs authorization/authentication

Hi!

I have looked into the SOO tool for some weeks as I am trying to perform a security analysis for some specific services. As far as I understand, DNS rebinding is more difficult to take advantage of if authentication/authorization is required by the service which runs on localhost on a specific port, right? Is this also the case when employing the attack Hook and Control?

More exactly, some of the services I am analyzing right now require a specific API key to send requests to their API endpoints or even username/password authentication to access their GUI hosted on http://localhost:{port}. This would make it difficult to actually send those requests without having knowledge of the login credentials or corresponding API key, right?

Thank you in advance!

The issue contains questions about DNS rebinding, authentication, authorization, and the Hook and Control attack, but it names no files, tests, or entry points. First clarify whether the project should document these security implications and identify the relevant documentation location; done would be an agreed, technically accurate explanation of the authentication and API-key behavior.