configure hosts for ActionDispatch::HostAuthorization middleware

[evgeni]

Why are you introducing these changes? (Problem description, related links)

moar secure

What are the changes introduced in this pull request?

configure hosts so that Rails can reject HTTP requests with invalid Host headrs

How to test this pull request

test in the patch

Checklist

• Tests added/updated (if applicable)
• Documentation updated (if applicable)

[evgeni]

needs cnames

[evgeni]

which makes me wonder, right now the parameter is --certificate-cname, but in reality this is not about certificates (only) [and we already identified that "cname" is wtong]

so should the parameter be something like --alternative-server-name

[ehelms]

I agree with the over-all principle here in a parameter that is above but feeds into certificates. Since naming is fun, other ideas:

--server-alias (how Apache defines it)
--server-name-alias

--subject-alternative-name (from certificates but still tied to that concept)

[evgeni]

I like --server-alias.

[evgeni]

the tests are failing because we use the IP address for smoker (as it runs on a system that has no working DNS towards the deployed foreman) and that's not allowed now.

possible solutions:

• allow the IP address with --server-alias
• figure out how to make DNS work for smoker (or manually override the Host header)

[ekohl]

figure out how to make DNS work for smoker (or manually override the Host header)

#305 is IMHO the easiest solution.