We are running a Discourse instance on our server, but we’ve encountered an issue where anyone can take our server’s public IP and create an A record on their own domain, effectively pointing their domain to our forum. We want to ensure that only our authorized domain can be used to access the forum and prevent unauthorized domains from working. What are the recommended ways to enforce domain restrictions in Discourse? Is there a configuration, Nginx setting, or other method to achieve this? Any guidance would be appreciated.

Are you using a standard install? By default discourse redirects to the hostname.

[图片] Jay Pfaffman: By default discourse redirects to the hostname How would that play any roll? OP suggests now that everyone can mess up practically every web services in the world. Never mind. That’s why we have to configure hosts for web services. Everywhere, everytime, including Discourse. So, such hijacking is useless, because right service, web server what ever will answer anyway.

Thanks @Jagster and @pfaffman - I am working with @Abdelrahman_MoHamed on this. For my own understanding, if this is our discourse domain: forum.get.it which points to → 34.170.141.119 And someone sets up, lets say.. hijack.get.it and points it to → 34.170.141.119 The expected behavior is that when someone types in: hijack.get.it it will redirect to forum.get.it Is that correct?

[图片] Jacob Peebles: The expected behavior is that when someone types in: hijack.get.it it will redirect to forum.get.it Yes. That’s the expected behavior and it appears to be the actual behavior. As far as I can tell you don’t have a problem. And most browsers will default to https: and https://hijackeddomain.com will generate a certificate error.

Yes, but nothing happens. Totally same thing that you have right now someone knocking using ssh, bots etc. If you set up such site/forum then yes they would send visitors who would see what ever you started using that domain. But they can’t hijack your domain, because you are telling to world wich nameserver that domain uses and to what IP it is pointing. And there is web server letting visitors in, if they are requesting such site you are configured for that domain. If request domain doesn’t get anything then doors stay closed.

[图片] Jacob Peebles: hijack.get.it it will redirect to forum.get.it I understand that was just an example, but that spesific situation is impossible, because you own domain get.it and its nameservers dont know such DNS that would point to hijack.get.it` :smirking_face:

[图片] Jacob Peebles: forum.get.it which points to → 34.170.141.119 And someone sets up, lets say… hijack.get.it and points it to → 34.170.141.119 Yes, @Jagster is right. If you own get.it (btw, wow, $$$$$) someone else cannot use your domain just with another subdomain.

防止未授权域名指向我们的Discourse实例

产品支持

pfaffman (Jay Pfaffman) 2025 年2 月 9 日 13:35 2

您使用的是标准安装吗？默认情况下，Discourse 会重定向到主机名。

话题		回复	浏览量
Deny access on domain name Self-hosting hosting	3	1344	2016 年11 月 7 日
Using Custom Domain Product Support	12	1373	2024 年7 月 20 日
After some hair pulling, I installed Discourse Self-hosting	2	658	2023 年2 月 22 日
Forcing access to Discourse via domain name only Self-hosting	4	998	2017 年10 月 5 日
Setup discourse.domain.com with main site at domain.com Self-hosting	5	1582	2020 年12 月 26 日

防止未授权域名指向我们的Discourse实例

相关话题