/ 
PAGI-0.001006
/ PAGI::Middleware::TrustedHosts

NAME

PAGI::Middleware::TrustedHosts - Host header validation middleware

SYNOPSIS

use PAGI::Middleware::Builder;

my $app = builder {
    enable 'TrustedHosts',
        hosts => ['example.com', 'www.example.com', '*.example.com'];
    $my_app;
};

DESCRIPTION

PAGI::Middleware::TrustedHosts validates the Host header against a list of allowed hosts. This helps prevent host header injection attacks.

CONFIGURATION

  • hosts (required)

    Array of allowed host patterns. Patterns can include: - Exact hostnames: 'example.com' - Wildcard subdomains: '*.example.com' - Port specifications: 'example.com:8080'

  • allow_empty (default: 0)

    If true, allow requests without a Host header.

HOST HEADER ATTACKS

Host header injection attacks can lead to:

  • Cache poisoning

  • Password reset poisoning

  • Server-Side Request Forgery (SSRF)

  • SQL injection in some cases

This middleware prevents these attacks by validating the Host header against a whitelist of allowed hosts.

SEE ALSO

PAGI::Middleware - Base class for middleware