ruby-on-rails - rails : HOST Header Attack vulnerability

Question

我非常担心我构建的网络应用程序的安全性，因此我一直在使用各种工具来抓取我的每个应用程序。

虽然在编程方面可以完成的所有事情都已经完成，但现成的类(如 Active Record)无法预见，但有一个问题我不断收到警报，我不知道从哪里开始解决这个问题。

我在 Nginx 和 Rails 4.1 后面运行 Unicorn。我不断收到的警报是这样的:

    An attacker can manipulate the Host header as seen by the 
web application and cause the application to behave in 
unexpected ways. Developers often resort to the exceedingly 
untrustworthy HTTP Host header (_SERVER["HTTP_HOST"] in PHP). 
Even otherwise-secure applications trust this value enough to 
write it to the page without HTML-encoding it with code equivalent to:

<link href="https://_SERVER['HOST']" (Joomla)

...and append secret keys and tokens to links containing it:

(Django, Gallery, others)

....and even directly import scripts from it:

(Various) 

发出以下建议:

The web application should use the SERVER_NAME instead
of the Host header. It should also create a dummy vhost 
that catches all requests with unrecognized Host headers. 
This can also be done under Nginx by specifying a non-wildcard 
SERVER_NAME, and under Apache by using a non-wildcard serverName 
and turning the UseCanonicalName directive on. Consult references 
for detailed information.

当然，无论如何..据我所知，这种漏洞通常是无害的，但在各种网络应用程序中可能有害，具体取决于它们的种类。

我该怎么做才能阻止这种攻击？感谢您的任何建议。

Answer 1

我找到了绕过该行为并停止收到警报的方法。我不知道这是否是最好的方法，因此接受评论、建议和新答案。

我们开始吧。

应用程序 Controller .rb

class ApplicationController < ActionController::Base
    before_action :debug_headers

private
    def debug_headers
        if request.env['HTTP_X_FORWARDED_HOST']
            request.env.except!('HTTP_X_FORWARDED_HOST') # just drop the variable
        end
    end # def

end # class