This middleware guards from DNS rebinding attacks by explicitly permitting the hosts a request can be sent to, and is passed the options set in config.host_authorization
.
Requests can opt-out of Host Authorization with exclude
:
config.host_authorization = { exclude: ->(request) { request.path =~ /healthcheck/ } }
When a request comes to an unauthorized host, the response_app
application will be executed and rendered. If no response_app
is given, a default one will run. The default response app logs blocked host info with level 'error' and responds with 403 Forbidden
. The body of the response contains debug info if config.consider_all_requests_local
is set to true, otherwise the body is empty.
Methods
Constants
ALLOWED_HOSTS_IN_DEVELOPMENT | = | [".localhost", IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0")] |
Class Public methods
new(app, hosts, exclude: nil, response_app: nil) Link
Instance Public methods
call(env) Link
# File actionpack/lib/action_dispatch/middleware/host_authorization.rb, line 130 def call(env) return @app.call(env) if @permissions.empty? request = Request.new(env) if authorized?(request) || excluded?(request) mark_as_authorized(request) @app.call(env) else @response_app.call(env) end end