Host header attack

[creative-coder]

I found a secure issue, in index.php line 35 'http://' . Environment::get('HTTP_HOST')
better would be 'http://' . Environment::get('SERVER_NAME') to prevent host header attack

http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html

[OmarElgabry]

Yes! you are right. However, give me some time to dig into this issue.

[creative-coder]

np, cool ;)

[creative-coder]

for little help, the request must come from the server origin, not from the host it selfs, thats the trick. host can be faked, server not

[OmarElgabry]

After digging into this issue, If found that, SERVER_NAME is more reliable but it can also be insecure as HTTP_HOST, Why? Because it depends on the server config. If UseCanonicalName is set Off in Apache(Default), SERVER_NAME will be constructed from the client supplied values.

Frameworks like Symphony check first if HTTP_HOST is available, if not, then check SERVER_NAME, and finally SERVER_ADDR. Then, they do some validation, and compare against allowed hosts. Thus, I'll implement the same behavior in a simpler way.

[OmarElgabry]

After this commit 1900ff0, Now, PUBLIC_ROOT can be assigned to a trusted host value, but, the host value still needs to be checked against a trusted list of host patterns, which will be done in my future plans.