next();

};

Server.prototype.checkHost = function (headers) {

Server.prototype.checkHost = function (headers, headerToCheck) {

// allow user to opt-out this security check, at own risk

if (this.disableHostCheck) {

return true;

}

if (!headerToCheck) headerToCheck = 'host';

// get the Host header and extract hostname

// we don't care about port not matching

const hostHeader = headers.host;

const hostHeader = headers[headerToCheck];

if (!hostHeader) {

return false;

return;

}

if (!this.checkHost(connection.headers)) {

this.sockWrite([ connection ], 'error', 'Invalid Host header');

if (!this.checkHost(connection.headers) || !this.checkHost(connection.headers, 'origin')) {

this.sockWrite([ connection ], 'error', 'Invalid Host/Origin header');

connection.close();