Merge pull request #1260 from diracdeltas/fix/add-hostname-opt

Add hostname option to mitigate DNS rebinding

1 files changed, 7 insertions, 0 deletions

diff --git a/lib/server.js b/lib/server.js
index 739933f..d2a9a60 100644
--- a/lib/server.js
+++ b/lib/server.js
@@ -51,6 +51,13 @@ function Server (torrent, opts) {
     // deny them
     if (req.headers.origin == null) return false
 
+    // If a 'hostname' string is specified, deny requests with a 'Host'
+    // header that does not match the origin of the torrent server to prevent
+    // DNS rebinding attacks.
+    if (opts.hostname && req.headers.host !== `${opts.hostname}:${server.address().port}`) {
+      return false
+    }
+
     // The user allowed all origins
     if (opts.origin === '*') return true