web-push
web-push copied to clipboard
Support option to use other HTTP clients
Hi, I'll like to propose adding an option that allows users to switch out the Net::HTTP
client for another HTTP client of their choice. By default, the Net::HTTP
client does not provide any protection against SSRF or DNS rebinding attacks so using this gem can easily lead to SSRF or DNS rebinding attacks if no endpoint validation is done by the application before sending out the payload. At https://github.com/discourse/discourse, we're using a patched version of Net::HTTP
to protect us against SSRF and DNS rebinding attacks and we would like an easy way to use another HTTP client for this gem without having to monkey patch. I was wondering if a PR for such a change will be welcomed.