Skip to content

Conversation

@mike-hoang
Copy link
Contributor

@mike-hoang mike-hoang commented Apr 28, 2022

What does this PR do?:

Currently, the nodejs-angular starter project returns a Invalid Host header when validating the deployed devfile stack on CI.

Disabling the host check will allow a successful request by bypassing a security check that can result in a DNS rebinding attack.

ref: https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a

Without a different testing strategy for registries, host checking will need to be disabled. The risk is low since the dev-server is only up for ~2mins on CI and immediately destroyed once a 200 status is returned.

However, when consuming the starter project (using it for development), --public-host should be specified and would look something like this:

ng serve --host 0.0.0.0 --public-host myhost.com

Which issue(s) this PR fixes:

Fixes devfile/api#799

Signed-off-by: Michael Hoang <[email protected]>
@mike-hoang mike-hoang marked this pull request as ready for review May 3, 2022 15:47
@johnmcollier johnmcollier merged commit bbd5e77 into devfile-samples:main May 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

broken nodejs-agular devfile

2 participants