Merge pull request #2277 from alphagov/add-hosts

Configure hosts for application
alphagov · Oct 24, 2024 · 4695baf · 4695baf
2 parents 80dbef0 + 77c4ce4
commit 4695baf
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/config/environments/production.rb b/config/environments/production.rb
@@ -89,4 +89,12 @@
   config.active_record.dump_schema_after_migration = false
 
   config.unreleased_features = ENV["UNRELEASED_FEATURES"].present?
+
+  # Enable DNS rebinding protection and other `Host` header attacks.
+  config.hosts = [
+    /collections-publisher\..*\.gov.uk/,
+  ]
+
+  # Skip DNS rebinding protection for the default health check endpoint.
+  config.host_authorization = { exclude: ->(request) { request.path.match?("^\/healthcheck") } }
 end