diff --git a/test/req.host.js b/test/req.host.js index cdda82eaae3..e4bd070031f 100644 --- a/test/req.host.js +++ b/test/req.host.js @@ -151,6 +151,20 @@ describe('req', function(){ .set('X-Forwarded-Host', 'evil') .expect('localhost', done); }) + + it('should ignore comma-separated X-Forwarded-Host', function(done){ + var app = express(); + + app.use(function(req, res){ + res.end(req.host); + }); + + request(app) + .get('/') + .set('Host', 'localhost') + .set('X-Forwarded-Host', 'example.com, foobar.com') + .expect('localhost', done); + }) }) }) })