config.ru

config.ru

# This file is used by Rack-based servers to start the application.

require ::File.expand_path('../config/environment', __FILE__)

#prevents DNS rebinding attacks
class DNSBinding
  VALID_HOSTS = %w{localhost:9292 myshop.dev:3000 myshopprod.com}
  def initialize(app)
    @app = app
  end
  def call(env)
    if VALID_HOSTS.include? env['HTTP_HOST']
      @app.call(env)
    else
      [403,{},["Invalid Host"]]
    end
  end
end
use DNSBinding
run Rails.application

@homakov why not go even further and suggest this be baked into Rails-core? at least for the default case localhost:3000, or even better, construct the VALID_HOSTS part dynamically on server start, since we can pick the port and the dev url easily. For production we insert a guideline in the security guide. Your thoughts?

@why-el i suggest it! it should be in core