Title: Security: add ignoreXForwardedHost option to block SSRF attacks by nico014 · Pull Request #241 · prerender/prerender-node · GitHub
Open Graph Title: Security: add ignoreXForwardedHost option to block SSRF attacks by nico014 · Pull Request #241 · prerender/prerender-node
X Title: Security: add ignoreXForwardedHost option to block SSRF attacks by nico014 · Pull Request #241 · prerender/prerender-node
Description: This option is a workaround to block potential SSRF attacks on Prerender servers until Prerender has found a way to address the vulnerability themselves. (It's been over 3 months at the time of writing.) If you run this request on a Prerender-enabled server: GET /get HTTP/1.1 User-Agent: TelegramBot x-forwarded-host: httpbin.org ..you will see the response from httpbin.org, which in this case returns details about the request and its origins. This means that one can have the Prerender server perform requests to outside hosts, even if they have nothing to do with the website that Prerender is enabled for. There is a name for this: Server Side Request Forgery. This PR adds an option to ignore the x-forwarded-host header, which contains the "payload", if any. BEWARE: the x-forwarded-host header might actually be needed in some situations (reverse proxy). I have added notes about this in the README file.
Open Graph Description: This option is a workaround to block potential SSRF attacks on Prerender servers until Prerender has found a way to address the vulnerability themselves. (It's been over 3 months at the time of...
X Description: This option is a workaround to block potential SSRF attacks on Prerender servers until Prerender has found a way to address the vulnerability themselves. (It's been over 3 months at the tim...
Opengraph URL: https://github.com/prerender/prerender-node/pull/241
X: @github
Domain: patch-diff.githubusercontent.com
| route-pattern | /:user_id/:repository/pull/:id/checks(.:format) |
| route-controller | pull_requests |
| route-action | checks |
| fetch-nonce | v2:22cadb19-18e8-9082-222d-58ee6b558ff6 |
| current-catalog-service-hash | 87dc3bc62d9b466312751bfd5f889726f4f1337bdff4e8be7da7c93d6c00a25a |
| request-id | E152:1E1254:1AA6F2C:22F3075:6992BE20 |
| html-safe-nonce | 41c0b5588236bc98f9ab19b14f887ef9100f34b07f28a5e492f2059eff96aef6 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJFMTUyOjFFMTI1NDoxQUE2RjJDOjIyRjMwNzU6Njk5MkJFMjAiLCJ2aXNpdG9yX2lkIjoiNDY3MzY2MzYxODA1MDYwNDU3NiIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | ea034468cc9d3360283011a0209bdf78b727f80ee9c0afe19062d662a0a8832f |
| hovercard-subject-tag | pull_request:1690093786 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,checks,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/prerender/prerender-node/pull/241/checks |
| twitter:image | https://avatars.githubusercontent.com/u/109740190?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/109740190?s=400&v=4 |
| og:image:alt | This option is a workaround to block potential SSRF attacks on Prerender servers until Prerender has found a way to address the vulnerability themselves. (It's been over 3 months at the time of... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 42c603b9d642c4a9065a51770f75e5e27132fef0e858607f5c9cb7e422831a7b |
| turbo-cache-control | no-preview |
| go-import | github.com/prerender/prerender-node git https://github.com/prerender/prerender-node.git |
| octolytics-dimension-user_id | 5633297 |
| octolytics-dimension-user_login | prerender |
| octolytics-dimension-repository_id | 13142168 |
| octolytics-dimension-repository_nwo | prerender/prerender-node |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 13142168 |
| octolytics-dimension-repository_network_root_nwo | prerender/prerender-node |
| turbo-body-classes | logged-out env-production page-responsive full-width full-width-p-0 |
| disable-turbo | false |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 84dcb133269e3cfe6e0296cc85fbacb92cae92bb |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width