WIP reject fake host headers

.circleci/config.yml

@@ -131,7 +131,7 @@ jobs:
                AppIsBehindCloudFront=True \
                AppLogRetentionDays=60 \
                DCEnvironment=$DC_ENVIRONMENT \
-
+               AppDomain='$PUBLIC_FQDN' \
               "
 
     - run:

Makefile

@@ -32,7 +32,7 @@ lambda-layers/FrontendDependenciesLayer/requirements.txt: Pipfile Pipfile.lock #
 
 .PHONY: aggregator/apps/api_docs/v1/templates/api_docs_rendered.html
 aggregator/apps/api_docs/v1/templates/api_docs_rendered.html: ## Rebuild the API documentation page
-	PIPELINE_ENABLED=True python manage.py build_docs
+	PIPELINE_ENABLED=True APP_DOMAIN=localhost python manage.py build_docs
 
 .PHONY: help
 # gratuitously adapted from https://marmelab.com/blog/2016/02/29/auto-documented-makefile.html

frontend/settings/base_lambda.py

@@ -1,10 +1,21 @@
 import os
 
-from boto3 import Session
+import boto3
 
 from .base import *  # noqa
 
-ALLOWED_HOSTS = ["*"]
+
+def get_api_gateway_urls():
+    client = boto3.client("apigateway")
+    response = client.get_rest_apis()
+    return [
+        f"{api['id']}.execute-api.eu-west-2.amazonaws.com"
+        for api in response["items"]
+        if api["name"].startswith("AggregatorApiApp-")
+    ]
+
+
+ALLOWED_HOSTS = [os.environ.get("APP_DOMAIN")]
 DEBUG = os.environ.get("DEBUG", False)
 
 WHITENOISE_AUTOREFRESH = False
@@ -71,7 +82,8 @@
 )
 
 if os.environ.get("AWS_EXECUTION_ENV"):
-    logger_boto3_session = Session(region_name="eu-west-2")
+    ALLOWED_HOSTS = ALLOWED_HOSTS + get_api_gateway_urls()
+    logger_boto3_session = boto3.Session(region_name="eu-west-2")
 
     LOGGING = {
         "version": 1,

template.yaml

@@ -20,6 +20,10 @@ Parameters:
     Default: AppDebug
     Type: AWS::SSM::Parameter::Value<String>
 
+  AppDomain:
+    Description: "The domain the app is on."
+    Type: String
+
   AppSentryDSN:
     Description: "The SENTRY_DSN environment variable passed to the app."
     Type: String
@@ -322,6 +326,7 @@ Resources:
           SMTP_HOST: !Ref AppSmtpHost
           SMTP_USERNAME: !Ref AppSmtpUser
           SMTP_PASSWORD: !Ref AppSmtpPass
+          APP_DOMAIN: !Ref AppDomain
       Events:
         HTTPRequests:
           Type: Api