server/security.ts

Host header validation middleware for DNS rebinding defense-in-depth.
Validates that the Host header matches expected local hostnames.
Requests without a Host header are allowed (HTTP/1.0, CLI tools).

Declarations
#

6 declarations

view source

build_allowed_hostnames
#

server/security.ts view source

(bind_host: string): Set<string>

Build the set of allowed hostnames for Host header validation
based on the server's bind address.
When binding to localhost or 127.0.0.1, both are allowed
(they refer to the same interface). When binding to 0.0.0.0,
all local hostnames are allowed since we can't know which
interface the request arrived on.

`bind_host`

the address the server is binding to

type string

returns

Set<string>

set of hostnames to accept in the Host header

create_host_validation_middleware
#

server/security.ts view source

(allowed_hostnames: Set<string>): Handler

Create middleware that validates the Host header against an allowlist.
Blocks requests whose Host header hostname doesn't match any allowed value.
The port portion of the Host header is stripped before comparison.
Requests without a Host header are allowed through (non-browser clients like curl or CLI).

`allowed_hostnames`

set of allowed hostnames (without port)

type Set<string>

returns

Handler

Hono middleware handler

extract_hostname
#

server/security.ts view source

(host: string): string

Extract the hostname portion from a Host header value.
Handles IPv6 brackets: [::1]:3000 → [::1]
Handles regular: localhost:3000 → localhost

`host`

the raw Host header value

type string

returns

string

the hostname without port

is_open_host
#

server/security.ts view source

(host: string): boolean

Check whether a bind address is a wildcard that exposes to the network.

`host`

the bind address to check

type string

returns

boolean

true if the host binds to all interfaces

LOCAL_HOSTNAMES
#

server/security.ts view source

ReadonlySet<string>

Default set of hostnames considered safe for local-only binding.
Includes all common ways to address localhost.

OPEN_HOST_ADDRESSES
#

server/security.ts view source

ReadonlySet<string>

Addresses that bind to all network interfaces.
These are dangerous without authentication because they expose the daemon to the LAN.