From 8eb8585d8fdd2e57e104b4ad39a8a15e45c237d1 Mon Sep 17 00:00:00 2001 From: Teddy Ortega Date: Tue, 2 May 2017 11:00:35 -0400 Subject: [PATCH] add support for subdomain wildcard in 'allowedHosts' option --- lib/Server.js | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/lib/Server.js b/lib/Server.js index e39a42edf1..ee1bf43997 100644 --- a/lib/Server.js +++ b/lib/Server.js @@ -445,7 +445,19 @@ Server.prototype.checkHost = function(headers) { if(hostname === "127.0.0.1" || hostname === "localhost") return true; // allow if hostname is in allowedHosts - if(this.allowedHosts && this.allowedHosts.indexOf(hostname) >= 0) return true; + if(this.allowedHosts && this.allowedHosts.length) { + for(let hostIdx = 0; hostIdx < this.allowedHosts.length; hostIdx++) { + const allowedHost = this.allowedHosts[hostIdx]; + if(allowedHost === hostname) return true; + + // support "." as a subdomain wildcard + // e.g. ".example.com" will allow "example.com", "www.example.com", "subdomain.example.com", etc + if(allowedHost[0] === ".") { + if(hostname === allowedHost.substring(1)) return true; // "example.com" + if(hostname.endsWith(allowedHost)) return true; // "*.example.com" + } + } + } // allow hostname of listening adress if(hostname === this.listenHostname) return true;