Skip to content

Use host header to build full URL for is request to itself check#896

Closed
hansott wants to merge 2 commits intomainfrom
false-pos-ssrf
Closed

Use host header to build full URL for is request to itself check#896
hansott wants to merge 2 commits intomainfrom
false-pos-ssrf

Conversation

@hansott
Copy link
Member

@hansott hansott commented Jan 27, 2026

No description provided.

@codecov
Copy link

codecov bot commented Jan 27, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

// Build full URL from Host header (e.g. for http.createServer / Next.js)
const host = context.headers.host;
if (typeof host === "string" && host.length > 0) {
return `http://${host}${context.url}`;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It does not matter in this case because of the following code inside isRequestToItself, but maybe we should highlight that it does not determine the correct protocol?

  // Special case for HTTP/HTTPS ports
  // In production, the app will be served on port 80 and 443
  if (baseURLPort === 80 && outboundPort === 443) {
    return true;
  }
  if (baseURLPort === 443 && outboundPort === 80) {
    return true;
  }

@hansott
Copy link
Member Author

hansott commented Jan 28, 2026

Some problems with this PR, closing in favour of #796

@hansott hansott closed this Jan 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants