Skip to main content

ENV_TRUSTED_HOSTS

Constant ENV_TRUSTED_HOSTS 

Source
pub const ENV_TRUSTED_HOSTS: &str = "TENSOR_WASM_API_TRUSTED_HOSTS";
Expand description

Environment variable that, when set, restricts the set of Host header values the server will accept. Comma-separated list of authority strings (e.g. api.example.com,api2.example.com:8443). Unset = accept any Host, which is the previous behaviour but is unsafe behind a layered proxy that may pass arbitrary Host values through.

Closes api S-30 (lack of Host validation). The check rejects requests whose Host is not in the allowlist with 400 Bad Request.