dunglas / mercure / 35604875334

90%

master: 93%

Build Type

push

github

Committed by dunglas

Commit Message

fix: refuse a request that carries no Host

A request with no Host (HTTP/1.0, or HTTP/2 with no :authority) leaves a hub
with no configured resource identifier with nothing to derive its identity
from. Refusing every token in that state kept an attacker from presenting one
audienced elsewhere, but the hub still served the request otherwise, deriving
an empty origin for the metadata URL it advertises.

(cherry picked from commit a61f21166)

Coverage Stats

7 of 7 new or added lines in 1 file covered. (100.0%)

11 existing lines in 3 files now uncovered.

2209 of 2511 relevant lines covered (87.97%)

181.15 hits per line