Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use $host instead of $http_host in nginx config [ci skip] #2403

Merged
merged 1 commit into from Oct 2, 2020
Merged

Use $host instead of $http_host in nginx config [ci skip] #2403

merged 1 commit into from Oct 2, 2020

Conversation

shouichi
Copy link
Contributor

@shouichi shouichi commented Oct 2, 2020 •
edited

Description

$http_host is vulnerable to host spoofing. Use $host instead. See https://github.com/yandex/gixy/blob/f5a54ad161a8f956eed0237ff689d49f7ed3a3e2/docs/en/plugins/hostspoofing.md

Your checklist for this pull request

  • I have reviewed the guidelines for contributing to this repository.
  • I have added an entry to History.md if this PR fixes a bug or adds a feature. If it doesn't need an entry to HISTORY.md, I have added [changelog skip] or [ci skip] to the pull request title.
  • I have added appropriate tests if this PR fixes a bug or adds a feature.
  • My pull request is 100 lines added/removed or less so that it can be easily reviewed.
  • If this PR doesn't need tests (docs change), I added [ci skip] to the title of the PR.
  • If this closes any issues, I have added "Closes #issue" to the PR description or my commit messages.
  • I have updated the documentation accordingly.
  • All new and existing tests passed, including Rubocop.

@shouichi shouichi changed the title Use $host instead of $http_host in nginx config [skip ci] Use $host instead of $http_host in nginx config [ci skip] Oct 2, 2020
@nateberkopec
Copy link
Member

Makes sense. Thanks!

@nateberkopec nateberkopec merged commit 57cb7bd into puma:master Oct 2, 2020
@shouichi shouichi deleted the nginx-config branch October 2, 2020 15:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@shouichi @nateberkopec