search

btrask / stronglink

A searchable, syncable, content-addressable notetaking system
Other
1.04k stars 45 forks source link

Verify Host header #69

Open btrask opened 8 years ago

btrask commented 8 years ago

We need to support verifying the HTTP Host header in order to prevent DNS rebinding. However, doing this properly will probably require user configuration. #6

I believe we can always accept localhost and 127.0.0.1. Then can we just use reverse DNS? More research required.