host-validation
Security and privacy
dns rebinding protection
SHOW HN2018
How HN took it
0 positive, 2 neutral or asking, 1 mixed, 3 critical, out of 6 comments about the project. Thread score -0.19.
Design: 0 for, 2 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful awareness of the DNS rebinding issue
From 1 comment
Neat, thanks for raising awareness of this issue. I don't think it makes a lot of sense for the web server case (as you said, using TLS would fix it and that seems like the…
arkadiyt on HN
Objections
Validating Referer header may block users who disable referer headers for privacy
From 1 comment
I understand validating the `Host` header but my understanding that the referer field is optional and theres quite a few users who either block referer headers for…
nacs on HN
Host header check alone is sufficient; Referer adds nothing
From 1 comment
Neat, thanks for raising awareness of this issue. I don't think it makes a lot of sense for the web server case (as you said, using TLS would fix it and that seems like the…
arkadiyt on HN
Recommends throwing errors on misspelled or duplicate header keys rather than silently preferring one
From 2 comments
If both keys exist, then it’s an even bigger signal of user mistake. Are you going to fail then? Distinction becomes pretty arbitrary. As a user, I’d rather have a failure at…
wild_preference on HNMay be a reasonable choice but I recommend just throwing.
partycoder on HN
Requests
Use Array.some instead of Array.filter for matching
From 1 comment
In this line: https://github.com/brannondorsey/host-validation/blob/2ba4672b82e2d956dd8614c87e2d846505be18d6/index.js#L91 use Array.some rather than iterating through all…
partycoder on HN
Warn about or enforce anchored regexes
From 1 comment
Neat, thanks for raising awareness of this issue. I don't think it makes a lot of sense for the web server case (as you said, using TLS would fix it and that seems like the…
arkadiyt on HN
Questions
Does the misspelled referer header take precedence over the correct referrer header when both are set?
From 1 comment
Does the misspelled version prevailed over the correct version if both are defined?
partycoder on HN