Security: Prevent Host Header Injection attacks

[dereuromark]

Summary

This PR fixes a critical security vulnerability that allows Host Header Injection attacks, which can be exploited to hijack password reset tokens and compromise user accounts.

The Vulnerability

The current implementation in config/bootstrap.php (lines 168-170) dynamically sets App.fullBaseUrl from the HTTP_HOST header when not configured:

$httpHost = env('HTTP_HOST');
if ($httpHost) {
    $fullBaseUrl = 'http' . $s . '://' . $httpHost;  // ⚠️ Trusts attacker input!
}

Attack Scenario

1. Attacker sends password reset request with malicious Host header: Host: attacker.com
2. Application generates reset URL: http://attacker.com/users/reset_password/valid-token-123
3. Victim receives email and clicks the malicious link
4. Attacker captures the valid reset token from their server logs
5. Attacker uses stolen token on legitimate domain to reset victim's password → Account takeover

The Fix

1. Changed config/app.php:

• Set App.fullBaseUrl to use APP_FULL_BASE_URL environment variable (instead of false)
• Enhanced security documentation explaining the risk
• Added clear configuration instructions

2. Enhanced config/bootstrap.php:

• Production mode: Throws exception if App.fullBaseUrl is not configured
• Development mode: Keeps HTTP_HOST fallback for convenience (with explicit warning)
• Added comprehensive security comments

3. Updated config/.env.example:

• Added APP_FULL_BASE_URL configuration with security documentation
• Provides example value for developers

Impact

Development

✅ No breaking changes - HTTP_HOST fallback still works in debug mode

Production

⚠️ Applications MUST configure APP_FULL_BASE_URL or will fail with clear error:

SECURITY: App.fullBaseUrl is not configured. 
This is required in production to prevent Host Header Injection attacks.
Set APP_FULL_BASE_URL environment variable or configure App.fullBaseUrl in config/app.php

This is intentional to force proper security configuration in production environments.

As this only applies to new apps, this is BC. current apps are most likely vulnerable in many cases, though.
Maybe debug kit or sth could warn here.

Configuration Options

Developers can configure this in multiple ways:

Option 1: Environment Variable (Recommended)

APP_FULL_BASE_URL=https://yourdomain.com

Option 2: config/app(_local).php

'App' => [
    'fullBaseUrl' => 'https://yourdomain.com',
]

Testing

Manual testing performed:

• ✅ Development mode with debug=true: Works as before (uses HTTP_HOST)
• ✅ Production mode without config: Throws clear security exception
• ✅ Production mode with config: Works correctly with configured URL

References

• OWASP: Host Header Injection
• PortSwigger: Host Header Attacks
• CakePHP Documentation: fullBaseUrl

Related Security Concern

The existing comment in config/app.php (line 42) already mentions "if you are concerned about people manipulating the Host header" but didn't enforce it. This PR makes that concern actionable by requiring explicit configuration in production.

[ADmad]

Wouldn't removing the false break local dev setups?

[dereuromark]

So we keep false here then as default?