@rpcbase/server 0.280.0 → 0.282.0

package/express/block_invalid_hosts.js

@@ -0,0 +1,27 @@
+/* @flow */
+const assert = require("assert")
+
+const {APP_DOMAIN} = process.env
+
+const is_production = process.env.NODE_ENV === "production"
+
+const block_invalid_hosts = (app) => {
+
+  // only block invalid hosts in production
+  if (!is_production) return
+
+  app.use((req, res, next) => {
+    // dockerip.host is needed for platform/reverse-proxy
+    if (![APP_DOMAIN, "dockerip.host"].includes(req.hostname)) {
+      console.log("request from invalid hostname", {
+        hostname: req.hostname,
+        url: req.url
+      })
+      req.connection.destroy()
+    } else {
+      next()
+    }
+  })
+}
+
+module.exports = block_invalid_hosts

package/express/index.js

@@ -11,6 +11,7 @@ const sessions = require("../src/sessions")
 
 const dev_save_coverage = require("./dev_save_coverage")
 const custom_cors = require("./custom_cors")
+const block_invalid_hosts = require("./block_invalid_hosts")
 
 const log = debug("rb:server")
 
@@ -45,7 +46,7 @@ module.exports = () => {
         }),
       ],
       // Performance Monitoring
-      tracesSampleRate: 1.0, // Capture 100% of the transactions, reduce in production!,
+      tracesSampleRate: 0.5, // Capture 100% of the transactions, reduce in production!,
     })
 
     // Trace incoming requests
@@ -53,6 +54,8 @@ module.exports = () => {
     app.use(Sentry.Handlers.tracingHandler())
   }
 
+  block_invalid_hosts(app)
+
   app.use(request_ip.mw())
 
   app.use(body_parser.json({limit: `${BODY_MAX_SIZE_MB}mb`}))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rpcbase/server",
-  "version": "0.280.0",
+  "version": "0.282.0",
   "license": "SSPL-1.0",
   "main": "./index.js",
   "bin": {