tornadoweb / tornadoweb/tornado
Provide a `host` application setting
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 22.2k
- Forks
- 5.6k
- Avg merge
- 3h 42m
- Merged PRs (30d)
- 16
Description
The docs, and almost every Tornado code example on the internet adds handlers to an Application via the handlers argument to the constructor. That means the application accepts requests for any host.
But listening to wildcard hosts is vulnerable to HTTP Host header vulnerability.
Please provide a new app setting called host which, if set, will be used to match all incoming requests.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Tornado's Application constructor and the handlers argument, then trace how incoming requests are matched against their Host header. Define what the new host setting should match for every request and verify the behavior against the existing application examples and request-routing behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100