W3cubDocs

/Ruby on Rails 7.0

class ActionDispatch::HostAuthorization

Parent:
Object

This middleware guards from DNS rebinding attacks by explicitly permitting the hosts a request can be sent to, and is passed the options set in config.host_authorization.

Requests can opt-out of Host Authorization with exclude:

config.host_authorization = { exclude: ->(request) { request.path =~ /healthcheck/ } }

When a request comes to an unauthorized host, the response_app application will be executed and rendered. If no response_app is given, a default one will run. The default response app logs blocked host info with level 'error' and responds with 403 Forbidden. The body of the response contains debug info if config.consider_all_requests_local is set to true, otherwise the body is empty.

Constants

ALLOWED_HOSTS_IN_DEVELOPMENT

Public Class Methods

new(app, hosts, exclude: nil, response_app: nil) Show source
# File actionpack/lib/action_dispatch/middleware/host_authorization.rb, line 122
def initialize(app, hosts, exclude: nil, response_app: nil)
  @app = app
  @permissions = Permissions.new(hosts)
  @exclude = exclude

  @response_app = response_app || DefaultResponseApp.new
end

Public Instance Methods

call(env) Show source
# File actionpack/lib/action_dispatch/middleware/host_authorization.rb, line 130
def call(env)
  return @app.call(env) if @permissions.empty?

  request = Request.new(env)

  if authorized?(request) || excluded?(request)
    mark_as_authorized(request)
    @app.call(env)
  else
    @response_app.call(env)
  end
end

© 2004–2021 David Heinemeier Hansson
Licensed under the MIT License.