config.ru

config.ru

# This file is used by Rack-based servers to start the application.

require ::File.expand_path('../config/environment', __FILE__)

#prevents DNS rebinding attacks
class DNSBinding
  VALID_HOSTS = %w{localhost:9292 myshop.dev:3000 myshopprod.com}
  def initialize(app)
    @app = app
  end
  def call(env)
    if VALID_HOSTS.include? env['HTTP_HOST']
      @app.call(env)
    else
      [403,{},["Invalid Host"]]
    end
  end
end
use DNSBinding
run Rails.application

@why-el i suggest it! it should be in core