Handle missing Host: header

lib/request.js

@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
@@ -445,7 +444,9 @@ req.__defineGetter__('auth', function(){
 
 req.__defineGetter__('subdomains', function(){
   var offset = this.app.get('subdomain offset');
-  return this.get('Host')
+  var host = this.get('Host');
+  if (!host) return [];
+  return host
     .split('.')
     .reverse()
     .slice(offset);
@@ -472,7 +473,10 @@ req.__defineGetter__('path', function(){
 req.__defineGetter__('host', function(){
   var trustProxy = this.app.get('trust proxy');
   var host = trustProxy && this.get('X-Forwarded-Host');
-  host = host || this.get('Host');
+  if (host === false || host === undefined)  // If X-Forwarded-Host is present but empty, return it.
+    host = this.get('Host');
+  if (host === undefined)
+    return null;
   return host.split(':')[0];
 });
 

package.json

@@ -43,7 +43,7 @@
     "should": "*",
     "connect-redis": "*",
     "github-flavored-markdown": "*",
-    "supertest": "0.0.1"
+    "supertest": "0.6.0"
   },
   "keywords": [
     "express",

test/req.host.js

@@ -0,0 +1,157 @@
+
+var express = require('../')
+  , request = require('./support/http');
+
+
+describe('req', function(){
+  describe('.host', function(){
+    describe('when X-Forwarded-Host is present', function(){
+      describe('when "trust proxy" is enabled', function(){
+        it('should return the forwarded header', function (done){
+          var app = express();
+
+          app.enable('trust proxy');
+
+          app.use(function (req, res, next){
+            res.send(req.host);
+          });
+
+          request(app)
+          .get('/')
+          .set('Host', 'proxy.example.com:80')
+          .set('X-Forwarded-Host', 'example.com:80')
+          .expect('example.com', done);
+        })
+
+        it('should return the forwarded header even if empty', function (done){
+          var app = express();
+
+          app.enable('trust proxy');
+
+          app.use(function (req, res, next){
+            res.send(req.host);
+          });
+
+          request(app)
+          .get('/')
+          .set('Host', 'proxy.example.com:80')
+          .set('X-Forwarded-Host', '')
+          .expect('', done);
+        })
+
+        it('should return null when there are no headers', function (done){
+          var app = express();
+
+          app.enable('trust proxy');
+
+          app.use(function (req, res, next){
+            res.send(JSON.stringify(req.host));
+          });
+
+          request(app)
+          .get('/')
+          .unset('Host')
+          .expect('null', done);
+        })
+      })
+
+      describe('when "trust proxy" is disabled', function(){
+        it('should return null when there is no Host header', function (done){
+          var app = express();
+
+          app.use(function (req, res, next){
+            res.send(JSON.stringify(req.host));
+          });
+
+          request(app)
+          .get('/')
+          .set('X-Forwarded-Host', 'example.com:80')
+          .unset('Host')
+          .expect('null', done);
+        })
+
+        it('should return empty string when there is an empty Host header', function (done){
+          var app = express();
+
+          app.use(function (req, res, next){
+            res.send(req.host);
+          });
+
+          request(app)
+          .get('/')
+          .set('X-Forwarded-Host', 'example.com:80')
+          .set('Host', '')
+          .expect('', done);
+        })
+
+        it('should return the actual host address', function(done){
+          var app = express();
+
+          app.use(function(req, res, next){
+            res.send(req.host);
+          });
+
+          request(app)
+          .get('/')
+          .set('Host', 'proxy.example.com:80')
+          .set('X-Forwarded-Host', 'example.com:80')
+          .expect('proxy.example.com', done);
+        })
+      })
+    })
+
+    describe('when X-Forwarded-Host is not present', function (){
+      it('should return the domain only', function(done){
+        var app = express();
+
+        app.use(function(req, res, next){
+          res.send(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'example.com:8080')
+        .expect('example.com', done);
+      })
+
+      it('should return the domain only even when there is no port', function(done){
+        var app = express();
+
+        app.use(function(req, res, next){
+          res.send(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'example.com')
+        .expect('example.com', done);
+      })
+
+      it('should return null when there is no Host header', function (done){
+        var app = express();
+
+        app.use(function(req, res, next){
+          res.send(JSON.stringify(req.host));
+        });
+
+        request(app)
+        .get('/')
+        .unset('Host')
+        .expect('null', done);
+      })
+
+      it('should return empty string when there is an empty Host header', function (done){
+        var app = express();
+
+        app.use(function (req, res, next){
+          res.send(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', '')
+        .expect('', done);
+      })
+    })
+  })
+})

test/req.subdomains.js

@@ -19,11 +19,11 @@ describe('req', function(){
       })
     })
 
-    describe('otherwise', function(){
-      it('should return an empty array', function(done){
+    describe('otherwise', function (){
+      it('should return an empty array', function (done){
         var app = express();
 
-        app.use(function(req, res){
+        app.use(function (req, res){
           res.send(req.subdomains);
         });
 
@@ -34,6 +34,36 @@ describe('req', function(){
       })
     })
 
+    describe('when there is no Host header', function (){
+      it('should return an empty array', function (done){
+        var app = express();
+
+        app.use(function (req, res, next){
+          res.send(req.subdomains);
+        });
+
+        request(app)
+        .get('/')
+        .unset('Host')
+        .expect([], done);
+      })
+    })
+
+    describe('when there is an empty Host header', function (){
+      it('should return an empty array', function (done){
+        var app = express();
+
+        app.use(function (req, res, next){
+          res.send(req.subdomains);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', '')
+        .expect([], done);
+      })
+    })
+
     describe('when subdomain offset is set', function(){
       describe('when subdomain offset is zero', function(){
         it('should return an array with the whole domain', function(done){
@@ -49,6 +79,38 @@ describe('req', function(){
           .set('Host', 'tobi.ferrets.sub.example.com')
           .expect('["com","example","sub","ferrets","tobi"]', done);
         })
+
+        describe('when there is no Host header', function (){
+          it('should return an empty array', function (done){
+            var app = express();
+            app.set('subdomain offset', 0);
+
+            app.use(function (req, res, next){
+              res.send(req.subdomains);
+            });
+
+            request(app)
+            .get('/')
+            .unset('Host')
+            .expect([], done);
+          })
+        })
+
+        describe('when there is an empty Host header', function (){
+          it('should return an empty array', function (done){
+            var app = express();
+            app.set('subdomain offset', 0);
+
+            app.use(function (req, res, next){
+              res.send(req.subdomains);
+            });
+
+            request(app)
+            .get('/')
+            .set('Host', '')
+            .expect([], done);
+          })
+        })
       })
 
       describe('when present', function(){

test/support/http.js

@@ -1,2 +1,6 @@
 
-module.exports = require('supertest');
+module.exports = require('supertest');
+module.exports.Test.prototype.unset = function (field) {
+  this.request().removeHeader(field);
+  return this;
+};