Logging ActionDispatch::HostAuthorization 503 responses

11 views
Skip to first unread message

Vincent Rolea

unread,
Dec 4, 2019, 5:51:10 AM12/4/19
to Ruby on Rails: Core
When testing webhooks integration using ngrok on a new Rails 6 app, I couldn't figure out why 403 response were returned in ngrok, and nothing was logged in the server logs.
I ended up learning about the new HostAuthorization middleware included in Rails 6 and the need for specifying hosts in the app config when different from localhost.

In some cases where you don't have access to html/text response from the server, like the one I experienced, I think it would be good to log it using the Rails.logger. HostAuthorization calls a default response app when host is not whitelisted, logging could happen there:

DEFAULT_RESPONSE_APP = -> env do
request = Request.new(env)

format = request.xhr? ? "text/plain" : "text/html"
template = DebugView.new(host: request.host)
body = template.render(template: "rescues/blocked_host", layout: "rescues/layout")
 
# Logging details about the reason of the 403
Rails.logger.error("Host host.com not included in host lists. Please add it to your config")

[403, {
"Content-Type" => "#{format}; charset=#{Response.default_charset}",
"Content-Length" => body.bytesize.to_s,
}, [body]]
end

Interested in feedback from the community!
Reply all
Reply to author
Forward
0 new messages