--- a/src/goodjava/lucene/backup/BackupServer.java	Sun Jun 12 18:48:01 2022 -0600
+++ b/src/goodjava/lucene/backup/BackupServer.java	Sun Jun 12 20:13:24 2022 -0600
@@ -3,8 +3,10 @@
 import java.io.File;
 import java.io.IOException;
 import java.util.Map;
+import java.net.InetAddress;
 import java.net.Socket;
 import java.net.ServerSocket;
+import java.net.UnknownHostException;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ExecutorService;
 import javax.net.ssl.SSLSocket;
@@ -71,6 +73,25 @@
 		logger.info("started server on port "+port);
 	}
 
+	private static String getName(RpcServer rpc,Object[] args) {
+		String domain = (String)args[0];
+		InetAddress addr;
+		try {
+			addr = InetAddress.getByName(domain);
+		} catch(UnknownHostException e) {
+			rpc.write( new RpcException("domain lookup failed") );
+			rpc.close();
+			return null;
+		}
+		if( !rpc.socket.getInetAddress().equals(addr) ) {
+			rpc.write( new RpcException("domain doesn't match client") );
+			rpc.close();
+			return null;
+		}
+		String name = (String)args[1];
+		return name==null ? domain : domain + "~" + name;
+	}
+
 	private void handle(Socket socket) {
 		RpcServer rpc = new RpcServer(socket);
 		Backup backup = null;
@@ -79,10 +100,12 @@
 			if( call == null )
 				break;
 			if( call.cmd.equals("exists") ) {
-				String name = (String)call.args[0];
+				String name = getName(rpc,call.args);
+				if( name==null )  return;
 				rpc.write( new RpcResult(new Object[]{new File(backupDir,name).exists()}) );
 			} else if( call.cmd.equals("login") ) {
-				String name = (String)call.args[0];
+				String name = getName(rpc,call.args);
+				if( name==null )  return;
 				synchronized(backups) {
 					backup = backups.get(name);
 					if( backup == null ) {