fix(server): allow Railway's healthcheck Host header - #7
Merged
Conversation
…y since the pairing PR The Host-header validation added in the security-hardening PR (d5e5fd9) only allowed localhost/127.0.0.1/[::1] and the deployment's own public domain. Railway's own healthcheck probe sends requests with a fixed, unrelated Host - healthcheck.railway.app - which that check had no reason to know about, so every healthcheck since that PR shipped got a 421 and Railway rolled the deploy back to the last one that could pass it. Confirmed via `railway logs`: the currently-active deployment is still from July 30 13:51 UTC (the Move Studio PR, #4) - both the security PR (#5) and the changelog PR (#6) built and pushed successfully but never went live, because their new server code rejected the one request that decides whether a deploy survives. Verified locally with RAILWAY_SERVICE_ID set (forces the cloud code path): Host: healthcheck.railway.app -> 200; Host: evil.com -> still 421.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a deploy-breaking regression from the security-hardening PR (#5): the new Host-header validation didn't recognize Railway's own healthcheck probe (
Host: healthcheck.railway.app), so it 421'd on every healthcheck and Railway rolled every subsequent deploy back to the last one that could pass it.Impact: confirmed via
railway logs/railway statusthat production has been running the pre-security-hardening build (from PR #4, July 30 13:51 UTC) this whole time — PR #5's and PR #6's deploys both built successfully but never actually went live.Test plan
RAILWAY_SERVICE_IDset to force the cloud code path:Host: healthcheck.railway.app→ 200,Host: evil.com→ still 421