Restricting client access based on the Host http header

Posted on

Hi Team,

About this issue, i have applied the expression filter but it wont work. I am using alias name as localhost and i got 403 forbidden error.
response-code(403)"/>

in this expression where should i give my host lists or hostname?

I want achieve the below mentioned rules.

Application should not trust the host header blindly
Developers should configure the whitelist of allowed hostnames.
Application should be configured with server name indication (SNI) functionality.

Thanks,
Dhanushkodi

Sb

Responses