From 9e85082758bcf067e000ffa200bd02f5f6c8d262 Mon Sep 17 00:00:00 2001 From: Sergei Poljanski Date: Thu, 2 Jul 2026 18:40:20 +0400 Subject: [PATCH] app: enable host authorization in production --- asxpio.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/asxpio.rb b/asxpio.rb index 91ebef4..afe0c12 100644 --- a/asxpio.rb +++ b/asxpio.rb @@ -43,7 +43,11 @@ class AsxpioWeb < Sinatra::Base set :root, $root set :erb, layout: :layout, escape_html: true set :show_exceptions, $env == 'development' - set :host_authorization, { permitted_hosts: [] } + # Traefik only routes our hostnames anyway; this is defense in depth. + # 127.0.0.1 is the Docker HEALTHCHECK. Empty list (= check disabled) + # outside production so dev and rack-test hosts keep working. + set :host_authorization, + { permitted_hosts: $env == 'production' ? ['asxp.io', 'www.asxp.io', '127.0.0.1'] : [] } end use Rack::Session::Cookie,