fix(@angular/ssr): support '*' in allowedHosts and warn about security risks#32827
fix(@angular/ssr): support '*' in allowedHosts and warn about security risks#32827alan-agius4 merged 2 commits intoangular:mainfrom
Conversation
| // eslint-disable-next-line no-console | ||
| console.warn( | ||
| 'Allowing all hosts via "*" is a security risk. This configuration should only be used when ' + | ||
| 'validation for "Host" and "X-Forwarded-Host" headers is performed in another layer.', |
There was a problem hiding this comment.
Consider: Can we expand on "another layer"? That feels vague enough that some devs might not understand what it means. Maybe say something about the production serving environment or cloud middleware / CDN / gateway handling this?
Also, should we include a link to some documentation in adev to 1) make clear that this is an Angular error, 2) draw a direct reference to the allowedHosts property, and 3) expand on the broader context of the problem this is catching (ie. why we have allowedHosts in the first place, what we mean by "hosts", etc.)?
| @@ -224,7 +224,7 @@ function verifyHostAllowed( | |||
| * @returns `true` if the hostname is allowed, `false` otherwise. | |||
| */ | |||
| function isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean { | |||
There was a problem hiding this comment.
Question: Do we care about the case of allowedHosts = new Set(['*', 'example.test'])? Should we warn / error for extra hosts which will no-op or is it fine to just silently ignore this case?
There was a problem hiding this comment.
I think it's fine to ignore this case and just warn about *
…y risks This commit adds support for '*' in allowedHosts for SSR, allowing any host to be validated. It also adds a security warning when '*' is used to inform users of the potential risks of allowing all host headers. Additionally, it enables '*' for the Vite dev server when 'allowedHosts' is set to 'true'. Closes angular#32729
25132c3 to
a4deca2
Compare
This commit adds support for '*' in allowedHosts for SSR, allowing any host to be validated. It also adds a security warning when '*' is used to inform users of the potential risks of allowing all host headers.
Additionally, it enables '*' for the Vite dev server when 'allowedHosts' is set to 'true'.
Closes #32729