Repository navigation
feat(client)!: check the Host header on each listener, add --allowed-host - #603
Open
mark1russell7 wants to merge 3 commits into
Open
mark1russell7 wants to merge 3 commits into
mark1russell7 wants to merge 3 commits into
Conversation
…host The browser checks examine the Host header on each listener, also on a LAN address. A request names a loopback name, an IP address or a name of browser.allowedHosts. The server command and mark --server get the option --allowed-host. @procedures/server exports parseAllowedHosts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first line of the changeset names the break and the default hosts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The browser checks of the procedure server examine the
Hostheader on each listener. Before, they examined it only on a loopback address. A server on a LAN address (0.0.0.0) accepted each host name.A request must name one of these hosts in its
Hostheader:localhost,127.0.0.1or[::1].192.168.1.20or[fe80::1]. With Docker port maps and NAT, the socket address and theHostdiffer. Each IP address passes, so these setups do not change.browser.allowedHostsof the host policy, with any letter case."*"turns the check off.A request with another name or without a
Hostheader getsFORBIDDEN(403) with the reasonhost-header-not-allowed. The message namesallowedHostsand--allowed-host, so an operator finds the change.--allowed-host <names>. Repeat the option, or separate the names with commas. A name has no port and no scheme.*turns the check off.@procedures/serverexportsparseAllowedHosts.mark --servergets the same option. A server on a LAN address without the option shows a hint.WIRE-PROTOCOL.md, and the README files of the server and ofmark.Checks
browser-guard.test.tshas 4 new tests:Host.1.2.3.4.evil.example,256.1.1.1,0x7f.0.0.1,[evil.example].allowedHostswith any letter case, on each listener.--allowed-host, and a started server with and without the option (200 and 403 byHost).mark: the parse of the repeated option, the option after a command (exit 1), and the host options of the server mode.vitest relatedfor the guard: 615 passed.markargs and server mode (35 passed), and of the MCP guard (20 passed).ste-lint.Version
MINOR of the client group. On a LAN listener, a request that names a host outside the list gets 403. The first line of the changeset names the break and the default hosts, and the changeset has the migration steps. Merge this change alone, after the release of the previous break. It has no deprecation release before it, because that release keeps the old behavior for one more cycle.
🤖 Generated with Claude Code