HostExtractable class final
The host a request was addressed to.
Read for multi-tenant routing, for building an absolute URL back to
yourself, or for refusing a Host nobody serves.
Treat it as untrusted. A client sends it, and a request that reached
your server with Host: evil.test says nothing about who owns the name. A
URL built from it and put in an email is a redirect anyone can aim. Compare
it against a list you control; do not interpolate it.
Behind a proxy the original host is in X-Forwarded-Host, and that is no
more trustworthy — a proxy you control may rewrite it, and anything else
can forge it. HostExtractable reads Host only, deliberately: preferring
a forwarded header by default would make a spoof the easy path.
- Implemented types
Constructors
- HostExtractable()
-
Reads the
Hostheader.const
Properties
- hashCode → int
-
The hash code for this object.
no setterinherited
- runtimeType → Type
-
A representation of the runtime type of the object.
no setterinherited
Methods
-
extract(
Request request) → Future< Result< String, Rejection> > -
Produces the value, or the rejection that stops the handler.
override
-
noSuchMethod(
Invocation invocation) → dynamic -
Invoked when a nonexistent method or property is accessed.
inherited
-
toString(
) → String -
A string representation of this object.
inherited
Operators
-
operator ==(
Object other) → bool -
The equality operator.
inherited