Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?:
Currently, the nodejs-angular starter project returns a
Invalid Host header
when validating the deployed devfile stack on CI.Disabling the host check will allow a successful request by bypassing a security check that can result in a DNS rebinding attack.
ref: https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a
Without a different testing strategy for registries, host checking will need to be disabled. The risk is low since the dev-server is only up for ~2mins on CI and immediately destroyed once a 200 status is returned.
However, when consuming the starter project (using it for development),
--public-host
should be specified and would look something like this:Which issue(s) this PR fixes:
Fixes devfile/api#799