Simple subdomains handler for CI3

This is very insecure as I can easily spoof my subdomain to an address.

This should be handled by having different environments

Can you elaborate on that?

Sure.

The subdomain is another form of user input. It can be modified by changing hosts files on unix based systems, not sure how to on windows. 

But for example, a user can change their settings so that admin.website.com is actually coming from somewhere else. This can leave room for vulnerabilities.

The safest and most secure way would be to setup the environment on your server rather than have your app choose. Having a .ENV file or an global environment setup through apache or something is the way to go. Some web hosting companies, like AWS, allow you to set environments on boot up of instances.

Ok, now let's analyse this with te following in mind:

- It's a SaaS app, so we have a wild subdomain configuration that's, then, validated on the application for a valid usage license. E.g: customer.app.ext is checked against a database table for a valid license. If not, the application shows an invalid license error.

What kind of vulnerabilities could we have with this kind of configuration?

An .env file is kind of useless to this logic and I can't see how could you spoof an invalid address that could bypass the license validation? At least not one that couldn't be used for all web addresses.

Thanks for your share

Best regards,
José Postiga
Senior Backend Developer