Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Whitelist all IP-address-like hosts names by default in checkHost #931

Closed
orteth01 opened this issue Jun 7, 2017 · 0 comments · Fixed by #1007
Closed

Whitelist all IP-address-like hosts names by default in checkHost #931

orteth01 opened this issue Jun 7, 2017 · 0 comments · Fixed by #1007

Comments

@orteth01
Copy link
Contributor

orteth01 commented Jun 7, 2017 •
edited
Loading

the problem:

Essentially, users desire the ability to whitelist certain IP addresses so that colleagues can access their dev server to view their work. However, they'd prefer to not have to specify each individual allowed IP.

the solution from @edmorley:

"it should be safe to whitelist all IP-addresses-like hosts names by default, which would save people having to whitelist them manually."
@orteth01 orteth01 changed the title Whitelist all IP-addresses-like hosts names by default in checkHost Whitelist all IP-address-like hosts names by default in checkHost Jun 8, 2017
@edmorley edmorley mentioned this issue Jul 24, 2017
Closed
usefulthink added a commit to usefulthink/webpack-dev-server that referenced this issue Jul 24, 2017
@usefulthink
Always allow requests with IP-address as host in checkHost()
d3fc704 
This patch will allow any requests made using an IP-address to always pass the
checkHost-test.

IP-addresses are not susceptible to a dns-rebind like attack so it would make
sense to not block them to make local-network development possible without
needing to disable the host-checks entirely.

fixes webpack#931
@usefulthink usefulthink mentioned this issue Jul 24, 2017
Merged
shellscape pushed a commit that referenced this issue Jul 27, 2017
@usefulthink @shellscape
Always allow requests with IP-address as host in checkHost() (#1007)
72efaab 
* Always allow requests with IP-address as host in checkHost()

This patch will allow any requests made using an IP-address to always pass the
checkHost-test.

IP-addresses are not susceptible to a dns-rebind like attack so it would make
sense to not block them to make local-network development possible without
needing to disable the host-checks entirely.

fixes #931

* use 'ip'-module to handle ip-address validation.

As per @shellscape's comment, switch to the
[ip](https://npmjs.com/package/ip)-module to do validation of
ip-address-format.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Always allow requests with IP-address as host in checkHost() usefulthink/webpack-dev-server
1 participant
@orteth01