aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/test/dispatch/host_authorization_test.rb
Commit message (Collapse)AuthorAgeFilesLines
* Add missing require for `IPAddr`yuuji.yaginuma2018-12-241-0/+1
| | | | Ref: https://travis-ci.org/rails/rails/jobs/469956825#L1694
* Introduce a guard against DNS rebinding attacksGenadi Samokovarov2018-12-151-0/+160
The ActionDispatch::HostAuthorization is a new middleware that prevent against DNS rebinding and other Host header attacks. By default it is included only in the development environment with the following configuration: Rails.application.config.hosts = [ IPAddr.new("0.0.0.0/0"), # All IPv4 addresses. IPAddr.new("::/0"), # All IPv6 addresses. "localhost" # The localhost reserved domain. ] In other environments, `Rails.application.config.hosts` is empty and no Host header checks will be done. If you want to guard against header attacks on production, you have to manually permit the allowed hosts with: Rails.application.config.hosts << "product.com" The host of a request is checked against the hosts entries with the case operator (#===), which lets hosts support entries of type RegExp, Proc and IPAddr to name a few. Here is an example with a regexp. # Allow requests from subdomains like `www.product.com` and # `beta1.product.com`. Rails.application.config.hosts << /.*\.product\.com/ A special case is supported that allows you to permit all sub-domains: # Allow requests from subdomains like `www.product.com` and # `beta1.product.com`. Rails.application.config.hosts << ".product.com"