host-validation
host-validation copied to clipboard
brannondorsey
Express.js middleware for "Host" and "Referer" header validation to protect against DNS rebinding attacks.
This commit adds [Prettier][0] to make the code style more consistent (related to #5). It also adds a few npm scripts to help with this: - `npm run lint` will...
how do we validate empty or undefined **referer**
It'd be great to add some code linting to enforce consistent code style. I use the somewhat-controversial [Standard](https://standardjs.com/) for Helmet, but I think some ESLint-derived code linting would be helpful....
This middleware is nice, but it doesn't seem to work with `app.set('trust proxy', true)`. In such a case, the header to validate would be `x-forwarded-host`. `request.hostname` will populate with `host`...
Metadata
Owner
Metadata
Express.js middleware for "Host" and "Referer" header validation to protect against DNS rebinding attacks.