class Rack::Protection::HostAuthorization

Prevented attack

DNS rebinding and other Host header attacks

Supported browsers

all

More infos

en.wikipedia.org/wiki/DNS_rebinding portswigger.net/web-security/host-header

Blocks HTTP requests with an unrecognized hostname in any of the following HTTP headers: Host, X-Forwarded-Host, Forwarded

If you want to permit a specific hostname, you can pass in as the ‘:permitted_hosts` option:

use Rack::Protection::HostAuthorization, permitted_hosts: ["www.example.org", "sinatrarb.com"]

The ‘:allow_if` option can also be set to a proc to use custom allow/deny logic.