I have a backend web server that serves an API (over HTTPS) to a frontend browser client on a different subdomain. It uses CORS to allow this.
The CORS spec directs you to not send the CORS headers if the origin isn't present or doesn't match your list of permitted origins, which I do.
But Section 6.3 adds that:
In addition to checking the Origin header, resource authors are strongly encouraged to also check the Host header. That is, make sure that the host name provided by that header matches the host name of the server on which the resource resides. This will provide protection against DNS rebinding attacks.
Is this valuable to add to our API server? My understanding is that DNS rebinding is an attack that you'd perform to access something on a local system like a router, so I'm not sure if that applies to us.
If we should check the
Host header, what action should we take? Just not sending back the CORS headers, or rejecting the request altogether? The first option makes more sense to me, since otherwise the recommendation wouldn't belong in a CORS spec, but the document is unclear.