class Bezel::Plug::HostAuthorization
include Bezel::Plug
Refuses a request whose Host header is not one of the application's
hosts (a 403), against DNS rebinding and links built from a forged
Host (Conn#url). A host is a name (shop.example), a name with a
leading dot for it and its subdomains (.shop.example), or an
address; the port is ignored and case does not matter.
p = Bezel::Plug::HostAuthorization.new(["shop.example", ".cdn.example"])
ok = HTTP::Server::Request.get("/", HTTP::Headers.of({"Host" => "img.cdn.example:8080"}))
p.call(Bezel::Conn.build(ok)).halted? # => false
Class methods
def self.new(hosts: Array[String]) -> Bezel::Plug::HostAuthorization
The plug, allowing hosts.
def self.strip_port(host: String) -> String?
host without its port ([::1]:80 is [::1]), or nil when it is
not a host with an optional port of digits.
Methods
def call(conn: Bezel::Conn) -> Bezel::Conn
The connection changed by this plug.
from Bezel::Plug