Class: Rails::Hyperdrive::Safety::RackMiddleware

Inherits:
Object
  • Object
show all
Defined in:
lib/rails/hyperdrive/safety/rack_middleware.rb

Overview

Defense-in-depth gate for every request that hits the MCP transport.

Constant Summary collapse

DEFAULT_ALLOWED_HOSTS = 
%w[localhost 127.0.0.1 [::1]].freeze

Instance Method Summary collapse

Constructor Details

#initialize(app, allowed_hosts: DEFAULT_ALLOWED_HOSTS) ⇒ RackMiddleware

Returns a new instance of RackMiddleware.



12
13
14
15
 
# File 'lib/rails/hyperdrive/safety/rack_middleware.rb', line 12

def initialize(app, allowed_hosts: DEFAULT_ALLOWED_HOSTS)
  @app = app
  @allowed_hosts = allowed_hosts
end

Instance Method Details

#call(env) ⇒ Object 



17
18
19
20
21
22
23
24
25
26
27
28
 
# File 'lib/rails/hyperdrive/safety/rack_middleware.rb', line 17

def call(env)
  unless dev?
    return forbid("hyperdrive is dev-only (Rails.env=#{rails_env})")
  end

  origin = env["HTTP_ORIGIN"]
  if origin && !origin_allowed?(origin)
    return forbid("origin not allowed: #{origin}")
  end

  @app.call(env)
end