Mitigate Host Header Attacks

[eliotsykes]

The X-Forwarded-Host HTTP header is always trusted and is used in url_for: rails/rails#29893

Mitigations to consider:

• Set default_url_options[:host] and asset_host as described in https://github.com/ankane/secure_rails#host-header-injection. Note this is only a partial mitigation according to other reports.
• Strip X-Forwarded-Host header in rack middleware (see StripXForwardedHost middleware in The X-Forwarded-Host HTTP header is always trusted and is used in url_for rails/rails#29893 (comment))
• Block requests with invalid X-Forwarded-Host header with rack-attack's blocklist
• Set config.hosts to allowlist in all environments (Rails 6+, PR)
• Anything else?

(If using a rack middleware, one approach to testing this in a request spec: rspec/rspec-rails#1596 (comment))