fix(dev): reject unknown Host headers on internal dev endpoints

Author: danielroe

packages/nuxt-cli/src/dev/host-check.ts

@@ -0,0 +1,46 @@
+import { isIP } from 'node:net'
+
+/**
+ * Hostname of an HTTP `Host` header: lowercased, port stripped, IPv6 brackets
+ * removed. `undefined` for a value that cannot be a hostname at all.
+ */
+export function parseHostHeader(host: string | undefined): string | undefined {
+  if (!host) {
+    return undefined
+  }
+  const value = host.trim().toLowerCase()
+  if (value.startsWith('[')) {
+    const end = value.indexOf(']')
+    return end > 1 ? value.slice(1, end) : undefined
+  }
+  const hostname = value.split(':')[0]
+  return hostname || undefined
+}
+
+/**
+ * Whether a request's `Host` header names this dev server, guarding the CLI's
+ * own endpoints (the progress stream, the loading page and the error page)
+ * against DNS rebinding, where a hostname the attacker controls resolves to
+ * this machine and a page in the developer's own browser becomes same-origin
+ * with the dev server.
+ *
+ * IP literals are always accepted: rebinding needs a DNS name, and devices on
+ * a permitted network reach a non-loopback bind by address. A missing `Host`
+ * is accepted too, since it cannot come from a browser.
+ */
+export function isAllowedHost(host: string | undefined, allowedHosts: ReadonlySet<string>): boolean {
+  if (!host) {
+    return true
+  }
+  const hostname = parseHostHeader(host)
+  if (!hostname) {
+    return false
+  }
+  if (hostname === 'localhost' || hostname.endsWith('.localhost')) {
+    return true
+  }
+  if (isIP(hostname)) {
+    return true
+  }
+  return allowedHosts.has(hostname)
+}

packages/nuxt-cli/src/dev/progress.ts

@@ -1,7 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http'
 
 /** Path prefix reserved for the CLI's own dev-time endpoints. */
-const DEV_INTERNAL_PREFIX: string = '/__nuxt_dev__/'
+export const DEV_INTERNAL_PREFIX: string = '/__nuxt_dev__/'
 export const PROGRESS_PATH: string = `${DEV_INTERNAL_PREFIX}progress`
 const HEARTBEAT_INTERVAL = 15_000
 

packages/nuxt-cli/src/dev/utils.ts

@@ -34,11 +34,12 @@ import { acquireLock, formatLockError, getTakeoverPid, updateLock } from '../uti
 import { debug, logger, writeNotice } from '../utils/logger'
 import { loadNuxtManifest, resolveNuxtManifest, writeNuxtManifest } from '../utils/nuxt'
 import { renderError, renderErrorAnsi } from './error-lazy'
+import { isAllowedHost } from './host-check'
 import { bindListener, createListener, matchesBoundTarget, openBrowser, resolveOpenURL } from './listen'
 import { RECOVERY_SCRIPT, withProgress } from './loading-page'
 import { resolveDefaultLoadingTemplate } from './loading-template'
 import { resolvePortlessURLs } from './portless'
-import { DevProgress } from './progress'
+import { DEV_INTERNAL_PREFIX, DevProgress } from './progress'
 import { formatChangedKeys, formatRestartReason, formatSkippedReload, mergeRestartReasons, withConfigKeys } from './reason'
 import { encodeRequest, REQUEST_HEADER, runWithRequest } from './serving-state'
 import { WarmupGate } from './warmup-gate'
@@ -391,6 +392,8 @@ export class NuxtDevServer extends EventEmitter<DevServerEventMap> {
   #rawConfig?: Record<string, unknown>
   #changedConfigKeys?: string[]
   #bound?: BoundServer
+  #allowedHosts = new Set<string>()
+  #allowAnyHost = false
   #openedEagerly = false
   #progress = new DevProgress()
   #warmup = new WarmupGate()
@@ -427,8 +430,13 @@ export class NuxtDevServer extends EventEmitter<DevServerEventMap> {
       // Internal endpoints answer before Nuxt exists, so they are matched ahead
       // of anything that waits on the first successful load, and they stay out
       // of the request feed.
-      if (this.#progress.handleRequest(req, res)) {
-        return
+      if ((req.url || '').split('?')[0]?.startsWith(DEV_INTERNAL_PREFIX)) {
+        if (this.#rejectDisallowedHost(req, res)) {
+          return
+        }
+        if (this.#progress.handleRequest(req, res)) {
+          return
+        }
       }
       if (!options.captureUIEvents) {
         return this.#serve(req, res)
@@ -456,8 +464,56 @@ export class NuxtDevServer extends EventEmitter<DevServerEventMap> {
     }
   }
 
+  /**
+   * Answer a request whose `Host` header does not name this server, so pages
+   * loaded from a rebinding hostname cannot read the CLI's own endpoints.
+   * Returns `true` when the request was rejected. Requests the app itself
+   * serves are not gated here: Vite applies its own `allowedHosts` check.
+   */
+  #rejectDisallowedHost(req: IncomingMessage, res: ServerResponse): boolean {
+    if (this.#allowAnyHost || isAllowedHost(req.headers.host, this.#allowedHosts)) {
+      return false
+    }
+    if (this.options.captureUIEvents) {
+      this.#internalResponses.add(res)
+    }
+    if (!res.headersSent) {
+      res.statusCode = 403
+      res.setHeader('Content-Type', 'text/plain')
+    }
+    res.end('Forbidden: this host is not allowed. Pass `--host` to allow it.')
+    return true
+  }
+
+  /**
+   * Record the hostnames this server answers on, for the `Host` check on the
+   * CLI's own endpoints. `--public` opts out of the check entirely.
+   */
+  #syncAllowedHosts(options: ListenOptions): void {
+    this.#allowAnyHost = !!options.public
+    this.#allowedHosts.clear()
+    if (this.#allowAnyHost) {
+      return
+    }
+    if (options.hostname) {
+      this.#allowedHosts.add(options.hostname.toLowerCase())
+    }
+    for (const { url } of this.listener?.getURLs() ?? []) {
+      try {
+        const hostname = new URL(url).hostname.toLowerCase()
+        this.#allowedHosts.add(hostname.startsWith('[') ? hostname.slice(1, -1) : hostname)
+      }
+      catch {
+        // a malformed display URL is not a hostname to allow
+      }
+    }
+  }
+
   async #serve(req: IncomingMessage, res: ServerResponse): Promise<void> {
     if (this.#loadingError) {
+      if (this.#rejectDisallowedHost(req, res)) {
+        return
+      }
       if (this.options.captureUIEvents) {
         this.#internalResponses.add(res)
       }
@@ -467,6 +523,9 @@ export class NuxtDevServer extends EventEmitter<DevServerEventMap> {
       return
     }
     if (!this.#handler) {
+      if (this.#rejectDisallowedHost(req, res)) {
+        return
+      }
       if (this.options.captureUIEvents) {
         this.#internalResponses.add(res)
       }
@@ -874,6 +933,7 @@ export class NuxtDevServer extends EventEmitter<DevServerEventMap> {
     }
 
     this.listener = await createListener(this.#bound, listenOptions, { announce: false })
+    this.#syncAllowedHosts(listenOptions)
     this.emit('listening', { url: this.listener.url, urls: this.listener.getURLs(), confirmed: false })
 
     const knowsScheme = overrides.httpsEnabled !== undefined || hint?.https === false
@@ -903,6 +963,7 @@ export class NuxtDevServer extends EventEmitter<DevServerEventMap> {
       ...listenOptions,
       open: listenOptions.open && !this.#openedEagerly,
     })
+    this.#syncAllowedHosts(listenOptions)
     this.emit('listening', { url: this.listener.url, urls: this.listener.getURLs(), confirmed: true })
 
     if (listenOptions.public) {

packages/nuxt-cli/test/e2e/dev.spec.ts

@@ -156,6 +156,34 @@ describe('dev server', () => {
     }
   })
 
+  it('should reject internal endpoints for an unknown Host header', { timeout: 50_000 }, async () => {
+    const host = '127.0.0.1'
+    const port = await getPort({ host, port: 3034 })
+
+    const { result: { close } } = await runCommand('dev', [`--host=${host}`, `--port=${port}`, `--cwd=${fixtureDir}`]) as any
+
+    try {
+      // `fetch` refuses to forward a forged `Host`, so speak HTTP directly.
+      const { request } = await import('node:http')
+      const status = await new Promise<number | undefined>((resolve, reject) => {
+        const req = request({ host, port, path: '/__nuxt_dev__/progress', headers: { host: 'rebinding-attacker.com' } }, (res) => {
+          res.resume()
+          resolve(res.statusCode)
+        })
+        req.once('error', reject)
+        req.end()
+      })
+      expect(status).toBe(403)
+
+      const allowed = await fetch(`http://${host}:${port}/__nuxt_dev__/progress`)
+      expect(allowed.headers.get('content-type')).toBe('text/event-stream')
+      await allowed.body?.cancel()
+    }
+    finally {
+      await close()
+    }
+  })
+
   it('should handle multiple set-cookie headers correctly', { timeout: 50_000 }, async () => {
     await rm(join(fixtureDir, '.nuxt'), { recursive: true, force: true })
     const host = '127.0.0.1'

packages/nuxt-cli/test/unit/host-check.spec.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it } from 'vitest'
+
+import { isAllowedHost, parseHostHeader } from '../../src/dev/host-check'
+
+describe('parseHostHeader', () => {
+  it('strips the port', () => {
+    expect(parseHostHeader('example.com:3000')).toBe('example.com')
+  })
+
+  it('lowercases the hostname', () => {
+    expect(parseHostHeader('EXAMPLE.com')).toBe('example.com')
+  })
+
+  it('unwraps bracketed IPv6 literals', () => {
+    expect(parseHostHeader('[::1]:3000')).toBe('::1')
+  })
+
+  it('returns undefined for empty or malformed values', () => {
+    expect(parseHostHeader(undefined)).toBeUndefined()
+    expect(parseHostHeader('')).toBeUndefined()
+    expect(parseHostHeader(':3000')).toBeUndefined()
+    expect(parseHostHeader('[')).toBeUndefined()
+  })
+})
+
+describe('isAllowedHost', () => {
+  const none = new Set<string>()
+
+  it('accepts a missing Host header', () => {
+    expect(isAllowedHost(undefined, none)).toBe(true)
+  })
+
+  it('accepts localhost and .localhost subdomains', () => {
+    expect(isAllowedHost('localhost:3000', none)).toBe(true)
+    expect(isAllowedHost('app.localhost', none)).toBe(true)
+  })
+
+  it('accepts IP literals', () => {
+    expect(isAllowedHost('127.0.0.1:3000', none)).toBe(true)
+    expect(isAllowedHost('192.168.1.20:3000', none)).toBe(true)
+    expect(isAllowedHost('[::1]:3000', none)).toBe(true)
+  })
+
+  it('accepts hostnames on the allowlist, case-insensitively', () => {
+    const allowed = new Set(['dev.example.com'])
+    expect(isAllowedHost('dev.example.com:3000', allowed)).toBe(true)
+    expect(isAllowedHost('DEV.example.com', allowed)).toBe(true)
+  })
+
+  it('rejects hostnames not on the allowlist', () => {
+    expect(isAllowedHost('rebinding-attacker.com:3000', none)).toBe(false)
+    expect(isAllowedHost('localhost.evil.com', none)).toBe(false)
+  })
+
+  it('rejects malformed Host values', () => {
+    expect(isAllowedHost('[', none)).toBe(false)
+  })
+})