Merge pull request #17 from knownasilya/patch-4

Don't assume headers.host is set, fixes #16
edwardhotchkiss · Jul 17, 2015 · 2b0e779 · 2b0e779
2 parents 9fab404 + b354e2b
commit 2b0e779
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/lib/subdomain.js b/lib/subdomain.js
@@ -24,6 +24,11 @@ module.exports = function(options) {
     // get host & protocol
     var host = request.headers.host
       , protocol = request.socket.encrypted ? 'https' : 'http';
+
+    // Invalid request, since headers.host should be set, most likely a malicious attempt
+    if (!host) {
+      return response.sendStatus(400);
+    }
 
     // remove 'www' prefix from URL? (tacky, right?)
     if (options.removeWWW === true) {