fix: 🐛 bug which allows host header injection vuln

ministryofjustice · Oct 31, 2024 · 97be2a6 · 97be2a6
1 parent fd5cbd3
commit 97be2a6
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/templates/values.yaml.tpl b/templates/values.yaml.tpl
@@ -190,7 +190,7 @@ controller:
 %{ endif ~}
     server-snippet: |
       if ($scheme != 'https') {
-        return 308 https://$host$request_uri;
+        return 308 https://$server_name$request_uri;
       }
 
     #