ikarius6/codeigniter-trusted-hosts

In case you want to leave the base_url configuration empty for portability, it involves a risk: http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html To avoid security issues, you may want to configure a list of "trusted hosts". (for dev and test environments or multi-domain sites)

codeigniter-trusted-hosts's Issues

this don't work for me

Maybe i'm doing something wrong, how this supposed to work and how this is supposed to be used?

At the end of my application/config/config.php I added this line:

$config['trusted_hosts'] = array('localhost', 'mywebsite.com');

And copy the MY_config.php to application/core/

then I used this python script to test: https://github.com/1N3/XSSTracer

 $ ./xsstracer.py mywebsite.com 80
    __  ______ _____ 
    \ \/ / ___|_   _|
     \  /\___ \ | |  
     /  \ ___) || |  
    /_/\_|____/ |_|  

+ -- --=[Cross-Site Tracer v1.3 by 1N3 @ CrowdShield
+ -- --=[Target: mywebsite.com:80
+ -- --=[Site not vulnerable to Cross-Site Tracing!
+ -- --=[Site vulnerable to host header injection!