vee1e/subidx
1
0
Fork 0
mirror of https://github.com/vee1e/subidx.git synced 2026-09-01 17:57:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
subidx/internal/server
History
lakshit verma 9a232a950c
server: reject unexpected Host headers to block DNS rebinding 
The API accepted any Host header, so a page running a DNS rebinding
attack could point attacker.com at 127.0.0.1 and read the collected
index from the victim's browser as same-origin JavaScript. Requests
whose Host is not localhost/127.0.0.1/::1 now get 421; -allowed-hosts
extends the list for exposed deployments. Rate limiting keyed on the
victim's own IP provided no protection here.
2026-08-22 03:44:43 +05:30
..
helpers_test.go subidx: CT log tailer and crt.name-compatible subdomain search API 2026-08-21 14:26:32 +05:30
limiter.go server: cap rate limiter memory under key-flooding 2026-08-21 21:35:29 +05:30
limiter_test.go server: cap rate limiter memory under key-flooding 2026-08-21 21:35:29 +05:30
server.go server: reject unexpected Host headers to block DNS rebinding 2026-08-22 03:44:43 +05:30
server_test.go server: reject unexpected Host headers to block DNS rebinding 2026-08-22 03:44:43 +05:30