Fix PR Add a setting flag to allow optional use of X-Forwarded-Host

[t0rchwo0d]

No description provided.

[t0rchwo0d]

I'm sorry. I forgot to merge the updates from the main branch. Please wait a moment.

[t0rchwo0d]

I'm sorry. I forgot to merge the updates from the main branch. Please wait a moment.

It's done. Please review it

[dentarg]

This is not the solution we are looking for. For example, this does not account for the forwarded header.

I think we want something like Rails have, where you can allow values you trust for the host and forwarded host header: https://guides.rubyonrails.org/configuring.html#actiondispatch-hostauthorization

[t0rchwo0d]

This is not the solution we are looking for. For example, this does not account for the forwarded header.

I think we want something like Rails have, where you can allow values you trust for the host and forwarded host header: https://guides.rubyonrails.org/configuring.html#actiondispatch-hostauthorization

Hi, @dentarg

It's not Ruby, but I referred to Python Django's case.

I'm not a Ruby developer, so I chose the simplest way possible.

https://docs.djangoproject.com/en/5.0/ref/settings/#use-x-forwarded-host

[t0rchwo0d]

Hi, @dentarg

I think you want similar approach to fixing the issue as case in Rails.

• The X-Forwarded-Host HTTP header is always trusted and is used in url_for rails/rails#29893

Unfortunately, I'm not a Ruby expert but rather a security engineer, so I don't have the resources to write code at that level without any issues.

I mentioned it in the previous comment, but please also consider the approach used in Django for fixing the issue.

• django/django@893cea2

However, I can review the code for fixng issue.
Thank you for your review.

[dentarg]

As I've stated, just adding a setting use_x_forwarded_host does not cover the forwarded header.

[t0rchwo0d]

As I've stated, just adding a setting use_x_forwarded_host does not cover the forwarded header.

Okay, got it. I'll close this ticket.
Let me know if there are any updates on the reported issue.
I'll pass along the information to Synk for reference.

Thank you for your review.