pixl-server-web 2.0.2 → 2.0.4

package/README.md

@@ -441,6 +441,28 @@ This example would reject all incoming IP addresses from Apple and AT&T (who own
 
 When a new incoming connection is established, the socket IP is immediately checked against the blacklist, and if matched, the socket is "hard closed".  This is an early detection and rejection, before the HTTP request even comes in.  In this case a HTTP response isn't sent back (as the socket is simply slammed shut).  However, if you are using a load balancer or proxy, the user's true IP address might not be known until later on in the request cycle, once the HTTP headers are read in.  At that point all the user's IPs are checked against the blacklist again, and if any of them match, a `HTTP 403 Forbidden` response is sent back.
 
+## http_allow_hosts
+
+The `http_allow_hosts` property allows you to specify a list of hosts to allow on incoming requests.  Specifically, this matches the incoming HTTP `Host` request header, and the value must match at least one entry in the array (case-insensitive).  For example, if you are hosting your application behind a domain name, you may want to restrict incoming requests so that they must explicitly point to your domain name (and disallow requests to the IP address).  Here is how to set this up:
+
+```json
+	"http_allow_hosts": ["mydomain.com"]
+```
+
+In the above example, only requests to `mydomain.com` would be allowed.  All other domains or IP addresses in the URL would be rejected with a `HTTP 403 Forbidden` error.  Include multiple entries in the array for things like subdomains:
+
+```json
+	"http_allow_hosts": ["mydomain.com", "www.mydomain.com"]
+```
+
+Note that if your users have to specify a port number in the URL, this must be specified in the `http_allow_hosts` array as well (it matches the `Host` request header exactly).  So for example, if you are hosting an app on a non-standard port number, but you want to restrict the host, include the port like this:
+
+```json
+	"http_allow_hosts": ["mydomain.com:3000"]
+```
+
+If the `http_allow_hosts` array is empty or omitted entirely, all hosts are allowed.  This is the default behavior.
+
 ## http_rewrites
 
 If you need to rewrite certain incoming URLs on-the-fly, you can define rules in the `http_rewrites` object.  The basic format is as follows: keys are regular expressions matched on incoming URI paths, and the values are the substitution strings to use as replacements.  Here is a simple example:
@@ -789,6 +811,19 @@ Note that these are matched using logical OR, so only one of them needs to match
 
 This sets the idle socket timeout for all incoming HTTPS requests.  If omitted, the Node.js default is 2 minutes.  Please specify your value in seconds.
 
+## https_bind_address
+
+Optionally specify an exact local IP address to bind the HTTPS listener to.  By default this uses the value of [http_bind_address](#http_bind_address), but you can bind them differently using this property.  Example:
+
+```json
+{
+	"http_bind_address": "127.0.0.1",
+	"https_bind_address": "0.0.0.0"
+}
+```
+
+This example would cause the server to only listen on localhost for plain HTTP traffic, but listen on *all* network interfaces for HTTPS traffic.
+
 # Custom URI Handlers
 
 You can attach your own handler methods for intercepting and responding to certain incoming URIs.  So for example, instead of the URI `/api/add_user` looking for a static file on disk, you can have the web server invoke your own function for handling it, and sending a custom response.  

package/lib/http.js

@@ -208,7 +208,8 @@ module.exports = class HTTP {
 			
 			// do not try to write to socket if already closed
 			if ((err.code != 'ECONNRESET') && socket.writable) {
-				socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
+				if (err.code == 'HPE_INVALID_METHOD') socket.destroy();
+				else socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
 			}
 			socket._pixl_data.aborted = true;
 			

package/lib/https.js

@@ -206,7 +206,8 @@ module.exports = class HTTP2 {
 			
 			// do not try to write to socket if already closed
 			if ((err.code != 'ECONNRESET') && socket.writable) {
-				socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
+				if (err.code == 'HPE_INVALID_METHOD') socket.destroy();
+				else socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
 			}
 			socket._pixl_data.aborted = true;
 			

package/lib/request.js

@@ -71,6 +71,24 @@ module.exports = class Request {
 			return;
 		}
 		
+		// custom host allow list
+		if (this.allowHosts.length && !this.allowHosts.includes( ('' + request.headers['host']).toLowerCase() )) {
+			this.logError(403, "Forbidden: Host not allowed: " + (request.headers['host'] || 'n/a'), {
+				id: args.id,
+				host: request.headers['host'] || '',
+				useragent: request.headers['user-agent'] || '',
+				referrer: request.headers['referer'] || '',
+				cookie: request.headers['cookie'] || '',
+				url: this.getSelfURL(request, request.url) || request.url
+			});
+			this.sendHTTPResponse( args, 
+				"403 Forbidden", 
+				{ 'Content-Type': "text/html" }, 
+				"403 Forbidden\n"
+			);
+			return;
+		}
+		
 		// allow special URIs to skip the line
 		if (this.queueSkipMatch && request.url.match(this.queueSkipMatch)) {
 			this.logDebug(8, "Bumping request to front of queue: " + request.url);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pixl-server-web",
-	"version": "2.0.2",
+	"version": "2.0.4",
 	"description": "A web server component for the pixl-server framework.",
 	"author": "Joseph Huckaby <jhuckaby@gmail.com>",
 	"homepage": "https://github.com/jhuckaby/pixl-server-web",

package/web_server.js

@@ -47,6 +47,7 @@ module.exports = Class({
 		"http_enable_brotli": false,
 		"http_default_acl": ['127.0.0.1', '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16', '::1/128', 'fd00::/8', '169.254.0.0/16', 'fe80::/10'],
 		"http_blacklist": [],
+		"http_allow_hosts": [],
 		"http_log_requests": false,
 		"http_log_request_details": false,
 		"http_log_body_max": 32768,
@@ -243,6 +244,9 @@ class WebServer extends Component {
 				this.redirects.push(redirect);
 			}
 		}
+		
+		// custom host list
+		this.allowHosts = (this.config.get('http_allow_hosts') || []).map( function(host) { return host.toLowerCase(); } );
 	}
 	
 	startAll(callback) {