Skip to content

fix: use request.headers.host (with port) in buildResourceUrl #251

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
melvincarvalho merged 1 commit into from
Apr 3, 2026
Merged

fix: use request.headers.host (with port) in buildResourceUrl #251

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions src/auth/middleware.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ import { generateDatabrowserHtml, generateModuleDatabrowserHtml } from '../mashl
* @returns {string} Normalized resource URL
*/
function buildResourceUrl(request, urlPath) {
// Use request.headers.host (includes port) instead of request.hostname (strips port)
const host = request.headers.host || request.hostname;
if (request.subdomainsEnabled && request.baseDomain &&
request.hostname === request.baseDomain && !request.podName) {
Comment on lines +27 to 30

Copilot AI Apr 3, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

buildResourceUrl is used for WAC authorization decisions, but this change switches to request.headers.host directly. The Host header (and with trustProxy: true, proxy-provided host headers) is client-influenced and can be spoofed, which risks incorrect ACL matching across virtual hosts. Consider deriving the authority from Fastify’s trusted properties and only appending a validated port (or validating that headers.host matches request.hostname), and include x-forwarded-host when running behind a proxy (consistent with src/ap/index.js:70-78).

Copilot uses AI. Check for mistakes.
const pathMatch = urlPath.match(/^\/([^/]+)(\/.*)?$/);
Expand All @@ -33,7 +35,7 @@ function buildResourceUrl(request, urlPath) {
return `${request.protocol}://${podName}.${request.baseDomain}${remainder}`;
}
Comment on lines 29 to 36

Copilot AI Apr 3, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the subdomain-normalization branch, the returned URL omits any non-standard port even after introducing host with port. If the server runs subdomain mode on a non-default port, ACL URLs that include the port will still not match. Consider preserving the port when building ${podName}.${baseDomain} (e.g., by extracting the port from the incoming authority and appending it).

Copilot uses AI. Check for mistakes.
}
return `${request.protocol}://${request.hostname}${urlPath}`;
return `${request.protocol}://${host}${urlPath}`;
}

/**
Expand Down Expand Up @@ -180,7 +182,7 @@ function getErrorPage(statusCode, isAuthenticated, request) {
? "This resource is protected. You'll need to sign in to continue."
: "You're signed in, but you don't have permission to view this resource.";

const baseUrl = `${request.protocol}://${request.hostname}`;
const baseUrl = `${request.protocol}://${request.headers.host || request.hostname}`;

Comment on lines +185 to 186

Copilot AI Apr 3, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

baseUrl is built using request.headers.host and then interpolated into HTML attributes (e.g., href="${baseUrl}/"). Because Host is user-controlled, this can enable reflected HTML injection/XSS if the header contains characters like quotes. Prefer a sanitized/validated authority (or escape before injecting into HTML) rather than using the raw header value.

Copilot uses AI. Check for mistakes.
return `<!DOCTYPE html>
<html lang="en">
Expand Down