NAME

PAGI::Middleware::TrustedHosts - Host header validation middleware

SYNOPSIS

use PAGI::Middleware::Builder;

my $app = builder {
    enable 'TrustedHosts',
        hosts => ['example.com', 'www.example.com', '*.example.com'];
    $my_app;
};

DESCRIPTION

PAGI::Middleware::TrustedHosts validates the Host header against a list of allowed hosts. This helps prevent host header injection attacks.

CONFIGURATION

• hosts (required)

  Array of allowed host patterns. Patterns can include: - Exact hostnames: 'example.com' - Wildcard subdomains: '*.example.com' - Port specifications: 'example.com:8080'

• allow_empty (default: 0)

  If true, allow requests without a Host header.

HOST HEADER ATTACKS

Host header injection attacks can lead to:

• Cache poisoning

• Password reset poisoning

• Server-Side Request Forgery (SSRF)

• SQL injection in some cases

This middleware prevents these attacks by validating the Host header against a whitelist of allowed hosts.

SEE ALSO

PAGI::Middleware - Base class for middleware