84ed462f40
determine_base_url fell back to request.host when CLINCH_HOST was unset. Rails resolves request.host from X-Forwarded-Host behind a trusted proxy, so a spoofed header could make the forward-auth login redirect point at an attacker origin (host-header phishing). - Add config/initializers/clinch_host.rb: fail fast at boot in any non-local environment when CLINCH_HOST is blank. It anchors the OIDC issuer, WebAuthn RP ID, and login redirect, so it must be explicit, never inferred. - determine_base_url now uses CLINCH_HOST (guaranteed in production) with a safe localhost default for dev/test, and never reads the request host. - Simplify the spoofed-host regression test now that the fallback is safe. Verified: production boot aborts with a clear message when CLINCH_HOST is blank, and boots normally when set. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
14 lines
743 B
Ruby
14 lines
743 B
Ruby
# CLINCH_HOST is this IdP's canonical external origin, e.g. https://auth.example.com.
|
|
# It anchors the OIDC issuer, the WebAuthn RP ID, and the forward-auth login
|
|
# redirect. In deployed (non-local) environments it MUST be set explicitly and
|
|
# never inferred from request headers — X-Forwarded-Host is attacker-influenceable,
|
|
# so inferring the origin from it would allow host-header phishing and open
|
|
# redirects. Fail fast at boot rather than start in an unsafe configuration.
|
|
unless Rails.env.local?
|
|
if ENV["CLINCH_HOST"].blank?
|
|
raise "CLINCH_HOST must be set (e.g. https://auth.example.com). It is the " \
|
|
"canonical origin of this Clinch instance and must not be inferred " \
|
|
"from request headers."
|
|
end
|
|
end
|