Support X-Forwarded-Host with multiple hosts

Closes #6215.
2023-05-17 11:51:05 -08:00
parent 6745a46034
commit b3b971480f
2 changed files with 7 additions and 2 deletions
--- a/src/node/http.ts
+++ b/src/node/http.ts
@ -386,10 +386,14 @@ function getHost(req: express.Request): string | undefined {
    }
  }

-  // Honor X-Forwarded-Host if present.
+  // Honor X-Forwarded-Host if present.  Some reverse proxies will set multiple
+  // comma-separated hosts.
  const xHost = getFirstHeader(req, "x-forwarded-host")
  if (xHost) {
-    return xHost.trim().toLowerCase()
+    const firstXHost = xHost.split(",")[0]
+    if (firstXHost) {
+      return firstXHost.trim().toLowerCase()
+    }
  }

  const host = getFirstHeader(req, "host")