feat: validate incoming host header

[usualoma]

fixes #160, #161

What is this?

Validate the content of the host header of the request for security purposes.

Invalid values

If the following values are specified in the host header, a "400 Bad Request" is returned.

• Empty string (if no default hostname is specified)
• Including path or query parameter
  • localhost/path localhost?key=value
• Including invalid charactors
  • localhost<script>

Valid values

Host headers are only validated by character type, so "hostnames with invalid structure" or "hostnames that cannot be looked up" are considered valid and do not result in a "400 Bad Request". For example, the following host headers are considered valid

• . www...example.com ()

Default hostname

If you also want to accept HTTP 1.0 requests w/o Host header, you can call serve() as follows to ensure that the default hostname is used without error if there is no host header (or an empty string is specified).

serve({
    fetch: app.fetch,
    hostname: 'localhost', // should be associated with the IP address of the server
})

Tasks

• implement
• test

[usualoma]

@yusukebe
Would you please review?

[yusukebe]

Hi @usualoma

Thank you for handling it. I'll merge this and release the new version right now. The most important thing is to release it first.

[usualoma]

@yusukebe Thank you!