Skip to content

Instantly share code, notes, and snippets.

@homakov
Last active September 24, 2016 21:30
Show Gist options
  • Save homakov/ea001418ecf15319a3e0 to your computer and use it in GitHub Desktop.
Save homakov/ea001418ecf15319a3e0 to your computer and use it in GitHub Desktop.
config.ru
# This file is used by Rack-based servers to start the application.
require ::File.expand_path('../config/environment', __FILE__)
#prevents DNS rebinding attacks
class DNSBinding
VALID_HOSTS = %w{localhost:9292 myshop.dev:3000 myshopprod.com}
def initialize(app)
@app = app
end
def call(env)
if VALID_HOSTS.include? env['HTTP_HOST']
@app.call(env)
else
[403,{},["Invalid Host"]]
end
end
end
use DNSBinding
run Rails.application
@why-el
Copy link

why-el commented Jul 30, 2015

@homakov why not go even further and suggest this be baked into Rails-core? at least for the default case localhost:3000, or even better, construct the VALID_HOSTS part dynamically on server start, since we can pick the port and the dev url easily. For production we insert a guideline in the security guide. Your thoughts?

@homakov
Copy link
Author

homakov commented Jul 17, 2016

@why-el i suggest it! it should be in core

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment