[{"data":1,"prerenderedAt":180},["ShallowReactive",2],{"project-18108379":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":40,"post_text":41,"what":42,"said":68,"maker_in_thread":114,"shape":122,"grid":126,"attempts":141,"same_week":142,"maker_shows":171,"maker_hidden":172,"reader_version":173,"card":174},"18108379","host-validation","DNS rebinding protection for Express.js","title","Show HN: DNS rebinding protection for Express.js","https:\u002F\u002Fgithub.com\u002Fbrannondorsey\u002Fhost-validation","github.com","braxxox",1538341034,2018,30,8,1002,2155,47,"shown","security_privacy","dns rebinding protection","library",[24,25,26,27],"dns rebinding","express.js","host header validation","middleware","roasted",-0.192,{"positive":31,"neutral":32,"mixed":33,"critical":34},0,2,1,3,6,{"execution":37,"design":38,"idea":39},{"positive":31,"critical":33},{"positive":31,"critical":32},{"positive":31,"critical":31},[33,31,34,31,33,33,34,34],null,{"problem":43,"audience":41,"pricing":41,"motivation":41,"time_to_build":41,"stack":53,"openness":66,"stage":67,"team_size":67},{"value":44,"source":45,"evidence":46},"Protects Express servers from DNS rebinding attacks by validating Host and Referer headers","inferred",[47,49],{"id":48},"post",{"id":50,"by":51,"text":52},"18108640","arkadiyt","Neat, thanks for raising awareness of this issue. I don't think it makes a lot of sense for the web server case (as you said, using TLS would fix it and that seems like the…",[54,61],{"value":55,"source":45,"evidence":56},"JavaScript",[57],{"id":58,"by":59,"text":60},"18108567","partycoder","In this line: https:\u002F\u002Fgithub.com\u002Fbrannondorsey\u002Fhost-validation\u002Fblob\u002F2ba4672b82e2d956dd8614c87e2d846505be18d6\u002Findex.js#L91 use Array.some rather than iterating through all…",{"value":62,"source":63,"evidence":64},"Express.js","maker",[65],{"id":48},"open_source","unknown",{"praise":69,"objections":75,"requests":97,"questions":106,"alternatives":113},[70],{"value":71,"source":72,"evidence":73},"Useful awareness of the DNS rebinding issue","commenter",[74],{"id":50,"by":51,"text":52},[76,83,87],{"value":77,"source":72,"evidence":78},"Validating Referer header may block users who disable referer headers for privacy",[79],{"id":80,"by":81,"text":82},"18114570","nacs","I understand validating the `Host` header but my understanding that the referer field is optional and theres quite a few users who either block referer headers for…",{"value":84,"source":72,"evidence":85},"Host header check alone is sufficient; Referer adds nothing",[86],{"id":50,"by":51,"text":52},{"value":88,"source":72,"evidence":89},"Recommends throwing errors on misspelled or duplicate header keys rather than silently preferring one",[90,94],{"id":91,"by":92,"text":93},"18112029","wild_preference","If both keys exist, then it’s an even bigger signal of user mistake. Are you going to fail then? Distinction becomes pretty arbitrary. As a user, I’d rather have a failure at…",{"id":95,"by":59,"text":96},"18118372","May be a reasonable choice but I recommend just throwing.",[98,102],{"value":99,"source":72,"evidence":100},"Use Array.some instead of Array.filter for matching",[101],{"id":58,"by":59,"text":60},{"value":103,"source":72,"evidence":104},"Warn about or enforce anchored regexes",[105],{"id":50,"by":51,"text":52},[107],{"value":108,"source":72,"evidence":109},"Does the misspelled referer header take precedence over the correct referrer header when both are set?",[110],{"id":111,"by":59,"text":112},"18108637","Does the misspelled version prevailed over the correct version if both are defined?",[],{"comments":32,"answered":33,"key":115},[116,119],{"id":117,"text":118},"18108605","#1, good call! #2, usually I am 100% in agreement. But referer vs referrer in the HTTP spec is a special case. I chose to do this as referer is misspelled in the spec itself.",{"id":120,"text":121},"18108655","It does as it is the correct header name.",{"commenters":123,"max_depth":123,"maker_replies":32,"first_comment_mins":124,"lifespan_hours":125},5,39,29,[127,129,131,133,134,136,137,139],[58,31,33,128,59,31],"project\u002Fcritical\u002Fexecution",[117,31,31,130,11,33],"maker\u002Fneutral\u002Fexecution",[111,31,34,132,59,31],"project\u002Fneutral\u002Fexecution",[120,31,31,132,11,33],[91,31,33,135,92,31],"project\u002Fcritical\u002Fdesign",[95,31,33,135,59,31],[50,33,34,138,51,31],"project\u002Fmixed\u002Fidea",[80,32,34,140,81,31],"project\u002Fneutral\u002Fdesign",[],[143,148,153,158,162,167],{"id":144,"name":145,"points":146,"category":147},"18123058","Shipstreams",202,"consumer_social",{"id":149,"name":150,"points":151,"category":152},"18115256","MicroMDM",146,"infrastructure",{"id":154,"name":155,"points":156,"category":157},"18111721","Kabas",138,"languages",{"id":159,"name":160,"points":161,"category":152},"18129892","IPFS HLS Converter",126,{"id":163,"name":164,"points":165,"category":166},"18113779","Hyperfiddle",121,"dev_tools",{"id":168,"name":169,"points":170,"category":166},"18125789","ekill",107,4,false,"v2",{"id":175,"name":5,"line":6,"ai":172,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":176,"top":18,"kw":177,"maker":11,"domain":10,"tier":19,"attempts":31,"strip":178,"url":9,"mix":179,"praise":71,"objection":77,"sub":21},18108379,-0.19,[24,25,26,27],"10301133",[31,32,33,34],1794036570065]