Skip to content

fix: disabling host check #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

mike-hoang
Copy link
Contributor

@mike-hoang mike-hoang commented Apr 28, 2022

What does this PR do?:

Currently, the nodejs-angular starter project returns a Invalid Host header when validating the deployed devfile stack on CI.

Disabling the host check will allow a successful request by bypassing a security check that can result in a DNS rebinding attack.

ref: https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a

Without a different testing strategy for registries, host checking will need to be disabled. The risk is low since the dev-server is only up for ~2mins on CI and immediately destroyed once a 200 status is returned.

However, when consuming the starter project (using it for development), --public-host should be specified and would look something like this:

ng serve --host 0.0.0.0 --public-host myhost.com

Which issue(s) this PR fixes:

Fixes devfile/api#799

Signed-off-by: Michael Hoang <[email protected]>
@mike-hoang mike-hoang marked this pull request as ready for review May 3, 2022 15:47
@johnmcollier johnmcollier merged commit bbd5e77 into devfile-samples:main May 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

broken nodejs-agular devfile
2 participants