Configure hosts for application

Note: the healthcheck endpoints are requested by IP, not domain, so we need to specifically exclude them from the protection.
alphagov · Oct 8, 2024 · a2a3f7b · a2a3f7b
1 parent e3110e3
commit a2a3f7b
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/config/environments/production.rb b/config/environments/production.rb
@@ -83,4 +83,12 @@
 
   # Do not dump schema after migrations.
   config.active_record.dump_schema_after_migration = false
+
+  # Enable DNS rebinding protection and other `Host` header attacks.
+  config.hosts = [
+    /content-tagger\..*gov.uk?/,
+  ]
+
+  # Skip DNS rebinding protection for the default health check endpoint.
+  config.host_authorization = { exclude: ->(request) { request.path.match?("^\/healthcheck") } }
 end