Support X-Forwarded-Host with multiple hosts

Closes coder#6215.
typoniels · May 17, 2023 · b3b9714 · b3b9714
1 parent 6745a46
commit b3b9714
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/src/node/http.ts b/src/node/http.ts
@@ -386,10 +386,14 @@ function getHost(req: express.Request): string | undefined {
     }
   }
 
-  // Honor X-Forwarded-Host if present.
+  // Honor X-Forwarded-Host if present.  Some reverse proxies will set multiple
+  // comma-separated hosts.
   const xHost = getFirstHeader(req, "x-forwarded-host")
   if (xHost) {
-    return xHost.trim().toLowerCase()
+    const firstXHost = xHost.split(",")[0]
+    if (firstXHost) {
+      return firstXHost.trim().toLowerCase()
+    }
   }
 
   const host = getFirstHeader(req, "host")

diff --git a/test/unit/node/http.test.ts b/test/unit/node/http.test.ts
@@ -58,6 +58,7 @@ describe("http", () => {
       ;[
         ["host", test.host],
         ["x-forwarded-host", test.host],
+        ["x-forwarded-host", `${test.host}, ${test.host}`],
         ["forwarded", `for=127.0.0.1, host=${test.host}, proto=http`],
         ["forwarded", `for=127.0.0.1;proto=http;host=${test.host}`],
         ["forwarded", `proto=http;host=${test.host}, for=127.0.0.1`],