Merge pull request #3 from brave/upgrade_to_0.105.2

Upgrade to 0.105.2

lib/server.js

@@ -54,13 +54,6 @@ function Server (torrent, opts = {}) {
     // deny them
     if (req.headers.origin == null) return false
 
-    // If a 'hostname' string is specified, deny requests with a 'Host'
-    // header that does not match the origin of the torrent server to prevent
-    // DNS rebinding attacks.
-    if (opts.hostname && req.headers.host !== `${opts.hostname}:${server.address().port}`) {
-      return false
-    }
-
     // The user allowed all origins
     if (opts.origin === '*') return true
 
@@ -77,6 +70,13 @@ function Server (torrent, opts = {}) {
   }
 
   function onRequest (req, res) {
+    // If a 'hostname' string is specified, deny requests with a 'Host'
+    // header that does not match the origin of the torrent server to prevent
+    // DNS rebinding attacks.
+    if (opts.hostname && req.headers.host !== `${opts.hostname}:${server.address().port}`) {
+      return req.destroy()
+    }
+
     const pathname = new URL(req.url, 'http://example.com').pathname
 
     if (pathname === '/favicon.ico') {

package.json

@@ -1,7 +1,7 @@
 {
   "name": "webtorrent",
   "description": "Streaming torrent client",
-  "version": "0.105.1",
+  "version": "0.105.2",
   "author": {
     "name": "WebTorrent, LLC",
     "email": "[email protected]",