Mercurial > hg > orthanc-dicomweb
changeset 791:9c31fd31c12a default tip
AllowedHost: fix for localhost
| author | Alain Mazy <am@orthanc.team> |
|---|---|
| date | Tue, 22 Sep 2026 11:02:34 +0200 |
| parents | 9904dba50f88 |
| children | |
| files | NEWS Plugin/Configuration.cpp |
| diffstat | 2 files changed, 19 insertions(+), 9 deletions(-) [+] |
line wrap: on
line diff
--- a/NEWS Mon Sep 21 18:35:01 2026 +0200 +++ b/NEWS Tue Sep 22 11:02:34 2026 +0200 @@ -3,8 +3,10 @@ * New configuration "AllowedHosts" that defines a list of trusted hosts for the "Host", "X-Forwarded-Host", "Forwarded" HTTP headers. - POSSIBLE BREAKING CHANGE: if Orthanc is behind a reverse proxy, make sure to either + POSSIBLE BREAKING CHANGE: if Orthanc is accessed via a domain name, make sure to either define "Host" or "AllowedHosts" in the "DicomWeb" configuration section. + If Orthanc is accessed via "localhost" or "127.0.0.1", there is no need to configure them. + Version 1.24 (2026-08-19)
--- a/Plugin/Configuration.cpp Mon Sep 21 18:35:01 2026 +0200 +++ b/Plugin/Configuration.cpp Tue Sep 22 11:02:34 2026 +0200 @@ -552,6 +552,14 @@ return foundTrustedHost; } + static bool IsLocalhost(const std::string& host) + { + return boost::starts_with(host, "localhost:") // localhost.mydomain.com must be rejected !!! + || boost::starts_with(host, "127.0.0.1:") + || host == "localhost" + || host == "127.0.0.1"; + } + std::string GetBasePublicUrl(const HttpHeaders& headers) { assert(dicomWebConfiguration_.get() != NULL); @@ -620,20 +628,20 @@ host = "localhost:8042"; } - if (allowedHosts.size() == 0) + if (!IsLocalhost(host)) { - if (!boost::starts_with(host, "localhost") && !boost::starts_with(host, "127.0.0.1")) // always trust localhost + if (allowedHosts.size() == 0) { throw Orthanc::OrthancException( Orthanc::ErrorCode_InternalError, std::string("DICOMWeb plugin: no 'Host' defined and no 'AllowedHosts' defined although there are forwarded HTTP headers. Unable to trust the forwarded HTTP headers for host '") + host + "'."); } - } - else if (!IsAllowedHost(host, allowedHosts)) - { - throw Orthanc::OrthancException( - Orthanc::ErrorCode_InternalError, - std::string("DICOMWeb plugin: no 'Host' defined and the forwarded HTTP headers did not match any of the 'AllowedHosts'. Unable to trust the forwarded HTTP headers for host '") + host + "'."); + else if (!IsAllowedHost(host, allowedHosts)) + { + throw Orthanc::OrthancException( + Orthanc::ErrorCode_InternalError, + std::string("DICOMWeb plugin: no 'Host' defined and the forwarded HTTP headers did not match any of the 'AllowedHosts'. Unable to trust the forwarded HTTP headers for host '") + host + "'."); + } } return (https ? "https://" : "http://") + host + GetPublicRoot();