class ActionDispatch::HostAuthorization

This middleware guards from DNS rebinding attacks by explicitly permitting the hosts a request can be sent to.

When a request comes to an unauthorized host, the response_app application will be executed and rendered. If no response_app is given, a default one will run, which responds with +403 Forbidden+.

Constants

ALLOWED_HOSTS_IN_DEVELOPMENT
DEFAULT_RESPONSE_APP

Public Class Methods

new(app, hosts, response_app = nil) click to toggle source
# File lib/action_dispatch/middleware/host_authorization.rb, line 90
def initialize(app, hosts, response_app = nil)
  @app = app
  @permissions = Permissions.new(hosts)
  @response_app = response_app || DEFAULT_RESPONSE_APP
end

Public Instance Methods

call(env) click to toggle source
# File lib/action_dispatch/middleware/host_authorization.rb, line 96
def call(env)
  return @app.call(env) if @permissions.empty?

  request = Request.new(env)

  if authorized?(request)
    mark_as_authorized(request)
    @app.call(env)
  else
    @response_app.call(env)
  end
end

Private Instance Methods

authorized?(request) click to toggle source
# File lib/action_dispatch/middleware/host_authorization.rb, line 110
def authorized?(request)
  origin_host = request.get_header("HTTP_HOST")
  forwarded_host = request.x_forwarded_host&.split(/,\s?/)&.last

  @permissions.allows?(origin_host) && (forwarded_host.blank? || @permissions.allows?(forwarded_host))
end
mark_as_authorized(request) click to toggle source
# File lib/action_dispatch/middleware/host_authorization.rb, line 117
def mark_as_authorized(request)
  request.set_header("action_dispatch.authorized_host", request.host)
end