getfider / fider

Open platform to collect and prioritize feedback
https://fider.io
GNU Affero General Public License v3.0
2.87k stars 627 forks source link

enhancement: replace HOST_DOMAIN with BASE_URL #1069

Closed goenning closed 2 years ago

goenning commented 2 years ago

HOST_DOMAIN was introduced to avoid host attack, where an attacked could intercept the request, modify the Host header and Fider would send an email with a link using the hijacked Host domain. But this variable introduce multiple problems, for one, it's difficult to use in Kubernetes or behind any cloud load balancer.

This PR replaces it with BASE_URL, which is used when sending emails, but does not have any interference with the HTTP pipeline, meaning that Fider can be hosted on ANY url/port.