@@ -349,35 +349,49 @@ export function authenticateOrigin(req: express.Request): boolean {
349
349
try {
350
350
origin = new URL ( originRaw ) . host . trim ( ) . toLowerCase ( )
351
351
} catch ( error ) {
352
+ logger . debug ( `unable to parse malformed origin "${ originRaw } "; blocking request to ${ req . originalUrl } ` )
352
353
return false // Malformed URL.
353
354
}
354
355
356
+ // A missing host likely means the reverse proxy has not been configured to
357
+ // forward the host which means we cannot perform the check. Emit a warning
358
+ // so an admin can fix the issue.
359
+ const host = getHost ( req )
360
+ if ( ! host ) {
361
+ logger . warn ( `no host headers found; blocking request to ${ req . originalUrl } ` )
362
+ return false
363
+ }
364
+
365
+ if ( host !== origin ) {
366
+ logger . debug ( `host "${ host } " does not match origin "${ origin } "; blocking request to ${ req . originalUrl } ` )
367
+ return false
368
+ }
369
+ return true
370
+ }
371
+
372
+ /**
373
+ * Get the host from headers.
374
+ */
375
+ function getHost ( req : express . Request ) : string | undefined {
355
376
// Honor Forwarded if present.
377
+ let host : string
356
378
const forwardedRaw = getFirstHeader ( req , "forwarded" )
357
379
if ( forwardedRaw ) {
358
380
const parts = forwardedRaw . split ( / [ ; , ] / )
359
381
for ( let i = 0 ; i < parts . length ; ++ i ) {
360
382
const [ key , value ] = splitOnFirstEquals ( parts [ i ] )
361
383
if ( key . trim ( ) . toLowerCase ( ) === "host" && value ) {
362
- return origin === value . trim ( ) . toLowerCase ( )
384
+ return value . trim ( ) . toLowerCase ( )
363
385
}
364
386
}
365
387
}
366
388
367
389
// Honor X-Forwarded-Host if present.
368
390
const xHost = getFirstHeader ( req , "x-forwarded-host" )
369
391
if ( xHost ) {
370
- return origin === xHost . trim ( ) . toLowerCase ( )
392
+ return xHost . trim ( ) . toLowerCase ( )
371
393
}
372
394
373
- // A missing host likely means the reverse proxy has not been configured to
374
- // forward the host which means we cannot perform the check. Emit a warning
375
- // so an admin can fix the issue.
376
395
const host = getFirstHeader ( req , "host" )
377
- if ( ! host ) {
378
- logger . warn ( `no host headers found; blocking request to ${ req . originalUrl } ` )
379
- return false
380
- }
381
-
382
- return origin === host . trim ( ) . toLowerCase ( )
396
+ return host ? host . trim ( ) . toLowerCase ( ) : undefined
383
397
}
0 commit comments