X-Forwarded-Host is used over Host, can lead to security issues about bidi HOT 4 OPEN

I'm a little bit confused. While trusting those headers is bad, bidi acts as a whitelist system, and that effectively prevents this doesn't it?

from bidi.

I think I see the problem. Bidi has its own concept of what the actual host is, and you're reading the host header directly elsewhere in your application (for what?) and that could be set to evil.com.

from bidi.

I was using yada.context/url-for to create a URL for a link. They are internal links, so I could just as easily have used path-for.

I'm using :* as the host as I had issues with specifying it explicitly (don't remember what now). If the :host was specified in the vhosts-model, would that avoid the issues here?

from bidi.

Ah, I hadn't considered those functionalities together. I don't think :* is very safe then. Specifying a host should alleviate this.

from bidi.