Merge pull request #34993 from schuetzm/allow-subdomains-of-localhost

Subdomains of localhost are safe against DNS rebinding

railties/lib/rails/application/configuration.rb

@@ -30,7 +30,7 @@ def initialize(*)
         @filter_parameters                       = []
         @filter_redirect                         = []
         @helpers_paths                           = []
-        @hosts                                   = Array(([IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0"), "localhost"] if Rails.env.development?))
+        @hosts                                   = Array(([IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0"), ".localhost"] if Rails.env.development?))
         @public_file_server                      = ActiveSupport::OrderedOptions.new
         @public_file_server.enabled              = true
         @public_file_server.index_name           = "index"

railties/test/application/configuration_test.rb

@@ -2289,6 +2289,11 @@ class MyLogger < ::Logger
       MESSAGE
     end
 
+    test "the host whitelist includes .localhost in development" do
+      app "development"
+      assert_includes Rails.application.config.hosts, ".localhost"
+    end
+
     private
       def force_lazy_load_hooks
         yield # Tasty clarifying sugar, homie! We only need to reference a constant to load it.