tokio-rs/axum
1
0
Fork 0
mirror of https://github.com/tokio-rs/axum.git synced 2026-08-29 00:00:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add security note about extract::Host (#839)

Browse Source
This commit is contained in:
David Pedersen
2022-03-09 10:18:12 +01:00
committed by GitHub
parent 04dd7617a4
commit f9a94ca7eb
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
axum/src/extract/host.rs
+4 -1
View File
@@ -4,7 +4,7 @@ use super::{
}; };
use async_trait::async_trait; use async_trait::async_trait;
const X_FORWARDED_HOST_HEADER_KEY: &'static str = "X-Forwarded-Host"; const X_FORWARDED_HOST_HEADER_KEY: &str = "X-Forwarded-Host";
/// Extractor that resolves the hostname of the request. /// Extractor that resolves the hostname of the request.
/// ///
@@ -12,6 +12,9 @@ const X_FORWARDED_HOST_HEADER_KEY: &'static str = "X-Forwarded-Host";
/// - `X-Forwarded-Host` header /// - `X-Forwarded-Host` header
/// - `Host` header /// - `Host` header
/// - request target / URI /// - request target / URI
///
/// Note that user agents can set `X-Forwarded-Host` and `Host` headers to arbitrary values so make
/// sure to validate them to avoid security issues.
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
pub struct Host(pub String); pub struct Host(pub String);