Show HN: DNS rebinding protection for Express.js(github.com) |
Show HN: DNS rebinding protection for Express.js(github.com) |
Then this: https://github.com/brannondorsey/host-validation/blob/2ba467... is not something I would recommend. Don't try to fix bad input.
FWIW I think you can check just the Host header, it's always going to be present and can't be set by an attacker - referrer doesn't add anything extra and attackers can force requests with blank referrers.
Also all your example regexes are correctly anchored but I can see a developer shooting themselves in the foot with that - I'd maybe add some warnings around it or even programmatically enforce anchored regexes.
Anyhow thanks for the Show HN!
As a user, I’d rather have a failure at boot time if I got it wrong. Just because I had a typo once doesn’t mean I always make it. What if I tried to transform my own config? I’d have to follow special case your referers property like you did to keep it consistent.