In BaseFacebook I see 2 methods that blindly do something like headers['x-forwarded-host'] || headers.host.
The x-forwarded-host is not trustworthy, it can only be trusted if you know that there is a reverse proxy directly in front of node that sets it (express has it's own config for this). Otherwise x-forwarded-host can be manipulated to anything by the client.
In BaseFacebook I see 2 methods that blindly do something like
headers['x-forwarded-host'] || headers.host.The
x-forwarded-hostis not trustworthy, it can only be trusted if you know that there is a reverse proxy directly in front of node that sets it (express has it's own config for this). Otherwisex-forwarded-hostcan be manipulated to anything by the client.