feat: add $allowedHostnames for multiple domain support

app/Config/App.php

@@ -24,6 +24,20 @@ class App extends BaseConfig
  */
  public string $baseURL = 'http://localhost:8080/';
 
+ /**
+ * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
+ * If you want to accept multiple Hostnames, set this.
+ *
+ * E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
+ * also accepts 'http://media.example.com/' and
+ * 'http://accounts.example.com/':
+ * ['media.example.com', 'accounts.example.com']
+ *
+ * @var string[]
+ * @phpstan-var list<string>
+ */
+ public array $allowedHostnames = [];
+
  /**
  * --------------------------------------------------------------------------
  * Index File

system/HTTP/IncomingRequest.php

@@ -192,14 +192,12 @@ public function detectLocale($config)
  * Sets up our URI object based on the information we have. This is
  * either provided by the user in the baseURL Config setting, or
  * determined from the environment as needed.
+ *
+ * @deprecated $protocol and $baseURL are deprecated. No longer used.
  */
  protected function detectURI(string $protocol, string $baseURL)
  {
- // Passing the config is unnecessary but left for legacy purposes
- $config = clone $this->config;
- $config->baseURL = $baseURL;
-
- $this->setPath($this->detectPath($protocol), $config);
+ $this->setPath($this->detectPath($this->config->uriProtocol), $this->config);
  }
 
  /**
@@ -270,7 +268,7 @@ protected function parseRequestURI(): string
  }
 
  // This section ensures that even on servers that require the URI to contain the query string (Nginx) a correct
- // URI is found, and also fixes the QUERY_STRING getServer var and $_GET array.
+ // URI is found, and also fixes the QUERY_STRING Server var and $_GET array.
  if (trim($uri, '/') === '' && strncmp($query, '/', 1) === 0) {
  $query = explode('?', $query, 2);
  $uri = $query[0];
@@ -400,19 +398,26 @@ public function setPath(string $path, ?App $config = null)
 
  // It's possible the user forgot a trailing slash on their
  // baseURL, so let's help them out.
- $baseURL = $config->baseURL === '' ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
+ $baseURL = ($config->baseURL === '') ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
 
- // Based on our baseURL provided by the developer
- // set our current domain name, scheme
+ // Based on our baseURL and allowedHostnames provided by the developer
+ // and HTTP_HOST, set our current domain name, scheme.
  if ($baseURL !== '') {
+ $host = $this->determineHost($config, $baseURL);
+
+ // Set URI::$baseURL
+ $uri = new URI($baseURL);
+ $currentBaseURL = (string) $uri->setHost($host);
+ $this->uri->setBaseURL($currentBaseURL);
+
  $this->uri->setScheme(parse_url($baseURL, PHP_URL_SCHEME));
- $this->uri->setHost(parse_url($baseURL, PHP_URL_HOST));
+ $this->uri->setHost($host);
  $this->uri->setPort(parse_url($baseURL, PHP_URL_PORT));
 
  // Ensure we have any query vars
  $this->uri->setQuery($_SERVER['QUERY_STRING'] ?? '');
 
- // Check if the baseURL scheme needs to be coerced into its secure version
+ // Check if the scheme needs to be coerced into its secure version
  if ($config->forceGlobalSecureRequests && $this->uri->getScheme() === 'http') {
  $this->uri->setScheme('https');
  }
@@ -425,6 +430,27 @@ public function setPath(string $path, ?App $config = null)
  return $this;
  }
 
+ private function determineHost(App $config, string $baseURL): string
+ {
+ $host = parse_url($baseURL, PHP_URL_HOST);
+
+ if (empty($config->allowedHostnames)) {
+ return $host;
+ }
+
+ // Update host if it is valid.
+ $httpHostPort = $this->getServer('HTTP_HOST');
+ if ($httpHostPort !== null) {
+ [$httpHost] = explode(':', $httpHostPort, 2);
+
+ if (in_array($httpHost, $config->allowedHostnames, true)) {
+ $host = $httpHost;
+ }
+ }
+
+ return $host;
+ }
+
  /**
  * Returns the path relative to SCRIPT_NAME,
  * running detection as necessary.

system/HTTP/URI.php

@@ -11,8 +11,8 @@
 
 namespace CodeIgniter\HTTP;
 
+use BadMethodCallException;
 use CodeIgniter\HTTP\Exceptions\HTTPException;
-use InvalidArgumentException;
 
 /**
  * Abstraction for a uniform resource identifier (URI).
@@ -36,6 +36,11 @@ class URI
  */
  protected $uriString;
 
+ /**
+ * The Current baseURL.
+ */
+ private ?string $baseURL = null;
+
  /**
  * List of URI segments.
  *
@@ -83,6 +88,11 @@ class URI
  /**
  * URI path.
  *
+ * Note: The constructor of the IncomingRequest class changes the path of
+ * the URI object held by the IncomingRequest class to a path relative
+ * to the SCRIPT_NAME. If the baseURL contains subfolders, this value
+ * will be different from the current URI path.
+ *
  * @var string
  */
  protected $path;
@@ -232,9 +242,12 @@ public static function removeDotSegments(string $path): string
  /**
  * Constructor.
  *
- * @param string $uri
+ * @param string|null $uri The URI to parse.
+ *
+ * @throws HTTPException
  *
- * @throws InvalidArgumentException
+ * @TODO null for param $uri should be removed.
+ * See https://www.php-fig.org/psr/psr-17/#26-urifactoryinterface
  */
  public function __construct(?string $uri = null)
  {
@@ -273,6 +286,8 @@ public function useRawQueryString(bool $raw = true)
  * Sets and overwrites any current URI information.
  *
  * @return URI
+ *
+ * @throws HTTPException
  */
  public function setURI(?string $uri = null)
  {
@@ -744,6 +759,30 @@ public function setPath(string $path)
  return $this;
  }
 
+ /**
+ * Sets the current baseURL.
+ *
+ * @interal
+ */
+ public function setBaseURL(string $baseURL): void
+ {
+ $this->baseURL = $baseURL;
+ }
+
+ /**
+ * Returns the current baseURL.
+ *
+ * @interal
+ */
+ public function getBaseURL(): string
+ {
+ if ($this->baseURL === null) {
+ throw new BadMethodCallException('The $baseURL is not set.');
+ }
+
+ return $this->baseURL;
+ }
+
  /**
  * Sets the path portion of the URI based on segments.
  *

system/Helpers/url_helper.php

@@ -9,6 +9,8 @@
  * the LICENSE file that was distributed with this source code.
  */
 
+use CodeIgniter\HTTP\CLIRequest;
+use CodeIgniter\HTTP\Exceptions\HTTPException;
 use CodeIgniter\HTTP\IncomingRequest;
 use CodeIgniter\HTTP\URI;
 use CodeIgniter\Router\Exceptions\RouterException;
@@ -19,14 +21,15 @@
 
 if (! function_exists('_get_uri')) {
  /**
- * Used by the other URL functions to build a
- * framework-specific URI based on the App config.
+ * Used by the other URL functions to build a framework-specific URI
+ * based on $request->getUri()->getBaseURL() and the App config.
  *
- * @internal Outside of the framework this should not be used directly.
+ * @internal Outside the framework this should not be used directly.
  *
  * @param string $relativePath May include queries or fragments
  *
- * @throws InvalidArgumentException For invalid paths or config
+ * @throws HTTPException For invalid paths.
+ * @throws InvalidArgumentException For invalid config.
  */
  function _get_uri(string $relativePath = '', ?App $config = null): URI
  {
@@ -37,7 +40,7 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  }
 
  // If a full URI was passed then convert it
- if (is_int(strpos($relativePath, '://'))) {
+ if (strpos($relativePath, '://') !== false) {
  $full = new URI($relativePath);
  $relativePath = URI::createURIString(
  null,
@@ -51,7 +54,14 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  $relativePath = URI::removeDotSegments($relativePath);
 
  // Build the full URL based on $config and $relativePath
- $url = rtrim($config->baseURL, '/ ') . '/';
+ $request = Services::request();
+
+ if ($request instanceof CLIRequest) {
+ /** @var App $config */
+ $url = rtrim($config->baseURL, '/ ') . '/';
+ } else {
+ $url = $request->getUri()->getBaseURL();
+ }
 
  // Check for an index page
  if ($config->indexPage !== '') {

system/Test/Mock/MockIncomingRequest.php

@@ -15,8 +15,4 @@
 
 class MockIncomingRequest extends IncomingRequest
 {
- protected function detectURI($protocol, $baseURL)
- {
- // Do nothing...
- }
 }

tests/system/HTTP/RedirectResponseTest.php

@@ -40,6 +40,8 @@ protected function setUp(): void
  {
  parent::setUp();
 
+ $this->resetServices();
+
  $_SERVER['REQUEST_METHOD'] = 'GET';
 
  $this->config = new App();
@@ -48,7 +50,12 @@ protected function setUp(): void
  $this->routes = new RouteCollection(Services::locator(), new Modules());
  Services::injectMock('routes', $this->routes);
 
- $this->request = new MockIncomingRequest($this->config, new URI('http://example.com'), null, new UserAgent());
+ $this->request = new MockIncomingRequest(
+ $this->config,
+ new URI('http://example.com'),
+ null,
+ new UserAgent()
+ );
  Services::injectMock('request', $this->request);
  }
 

tests/system/HTTP/ResponseTest.php

@@ -34,9 +34,9 @@ protected function setUp(): void
  {
  $this->server = $_SERVER;
 
- Services::reset();
-
  parent::setUp();
+
+ $this->resetServices();
  }
 
  protected function tearDown(): void
@@ -164,6 +164,8 @@ public function testSetLink()
  $config->baseURL = 'http://example.com/test/';
  Factories::injectMock('config', 'App', $config);
 
+ $this->resetServices();
+
  $response = new Response($config);
  $pager = Services::pager();
 

tests/system/Helpers/URLHelper/CurrentUrlTest.php

@@ -58,12 +58,38 @@ protected function tearDown(): void
 
  public function testCurrentURLReturnsBasicURL()
  {
- // Since we're on a CLI, we must provide our own URI
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
  $this->config->baseURL = 'http://example.com/public';
 
  $this->assertSame('http://example.com/public/index.php/', current_url());
  }
 
+ public function testCurrentURLReturnsAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://www.example.jp/public/index.php/', current_url());
+ }
+
+ public function testCurrentURLReturnsBaseURLIfNotAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'invalid.example.org';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://example.com/public/index.php/', current_url());
+ }
+
  public function testCurrentURLReturnsObject()
  {
  // Since we're on a CLI, we must provide our own URI

tests/system/Helpers/URLHelper/SiteUrlTest.php

@@ -281,14 +281,49 @@ public function testBaseURLService()
  $_SERVER['HTTP_HOST'] = 'example.com';
  $_SERVER['REQUEST_URI'] = '/ci/v4/x/y';
 
- $uri = new URI('http://example.com/ci/v4/x/y');
- Services::injectMock('uri', $uri);
-
  $this->config->baseURL = 'http://example.com/ci/v4/';
  $request = Services::request($this->config);
  Services::injectMock('request', $request);
 
  $this->assertSame('http://example.com/ci/v4/index.php/controller/method', site_url('controller/method', null, $this->config));
  $this->assertSame('http://example.com/ci/v4/controller/method', base_url('controller/method', null));
  }
+
+ public function testSiteURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/index.php/controller/method',
+ site_url('controller/method', null, $this->config)
+ );
+ }
+
+ public function testBaseURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/controller/method',
+ base_url('controller/method', null)
+ );
+ }
 }

app/Config/App.php

@@ -24,6 +24,20 @@ class App extends BaseConfig
  */
  public string $baseURL = 'http://localhost:8080/';
 
+ /**
+ * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
+ * If you want to accept multiple Hostnames, set this.
+ *
+ * E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
+ * also accepts 'http://media.example.com/' and
+ * 'http://accounts.example.com/':
+ * ['media.example.com', 'accounts.example.com']
+ *
+ * @var string[]
+ * @phpstan-var list<string>
+ */
+ public array $allowedHostnames = [];
+
  /**
  * --------------------------------------------------------------------------
  * Index File

system/HTTP/IncomingRequest.php

@@ -192,14 +192,12 @@ public function detectLocale($config)
  * Sets up our URI object based on the information we have. This is
  * either provided by the user in the baseURL Config setting, or
  * determined from the environment as needed.
+ *
+ * @deprecated $protocol and $baseURL are deprecated. No longer used.
  */
  protected function detectURI(string $protocol, string $baseURL)
  {
- // Passing the config is unnecessary but left for legacy purposes
- $config = clone $this->config;
- $config->baseURL = $baseURL;
-
- $this->setPath($this->detectPath($protocol), $config);
+ $this->setPath($this->detectPath($this->config->uriProtocol), $this->config);
  }
 
  /**
@@ -270,7 +268,7 @@ protected function parseRequestURI(): string
  }
 
  // This section ensures that even on servers that require the URI to contain the query string (Nginx) a correct
- // URI is found, and also fixes the QUERY_STRING getServer var and $_GET array.
+ // URI is found, and also fixes the QUERY_STRING Server var and $_GET array.
  if (trim($uri, '/') === '' && strncmp($query, '/', 1) === 0) {
  $query = explode('?', $query, 2);
  $uri = $query[0];
@@ -400,19 +398,26 @@ public function setPath(string $path, ?App $config = null)
 
  // It's possible the user forgot a trailing slash on their
  // baseURL, so let's help them out.
- $baseURL = $config->baseURL === '' ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
+ $baseURL = ($config->baseURL === '') ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
 
- // Based on our baseURL provided by the developer
- // set our current domain name, scheme
+ // Based on our baseURL and allowedHostnames provided by the developer
+ // and HTTP_HOST, set our current domain name, scheme.
  if ($baseURL !== '') {
+ $host = $this->determineHost($config, $baseURL);
+
+ // Set URI::$baseURL
+ $uri = new URI($baseURL);
+ $currentBaseURL = (string) $uri->setHost($host);
+ $this->uri->setBaseURL($currentBaseURL);
+
  $this->uri->setScheme(parse_url($baseURL, PHP_URL_SCHEME));
- $this->uri->setHost(parse_url($baseURL, PHP_URL_HOST));
+ $this->uri->setHost($host);
  $this->uri->setPort(parse_url($baseURL, PHP_URL_PORT));
 
  // Ensure we have any query vars
  $this->uri->setQuery($_SERVER['QUERY_STRING'] ?? '');
 
- // Check if the baseURL scheme needs to be coerced into its secure version
+ // Check if the scheme needs to be coerced into its secure version
  if ($config->forceGlobalSecureRequests && $this->uri->getScheme() === 'http') {
  $this->uri->setScheme('https');
  }
@@ -425,6 +430,27 @@ public function setPath(string $path, ?App $config = null)
  return $this;
  }
 
+ private function determineHost(App $config, string $baseURL): string
+ {
+ $host = parse_url($baseURL, PHP_URL_HOST);
+
+ if (empty($config->allowedHostnames)) {
+ return $host;
+ }
+
+ // Update host if it is valid.
+ $httpHostPort = $this->getServer('HTTP_HOST');
+ if ($httpHostPort !== null) {
+ [$httpHost] = explode(':', $httpHostPort, 2);
+
+ if (in_array($httpHost, $config->allowedHostnames, true)) {
+ $host = $httpHost;
+ }
+ }
+
+ return $host;
+ }
+
  /**
  * Returns the path relative to SCRIPT_NAME,
  * running detection as necessary.

system/HTTP/URI.php

@@ -11,8 +11,8 @@
 
 namespace CodeIgniter\HTTP;
 
+use BadMethodCallException;
 use CodeIgniter\HTTP\Exceptions\HTTPException;
-use InvalidArgumentException;
 
 /**
  * Abstraction for a uniform resource identifier (URI).
@@ -36,6 +36,11 @@ class URI
  */
  protected $uriString;
 
+ /**
+ * The Current baseURL.
+ */
+ private ?string $baseURL = null;
+
  /**
  * List of URI segments.
  *
@@ -83,6 +88,11 @@ class URI
  /**
  * URI path.
  *
+ * Note: The constructor of the IncomingRequest class changes the path of
+ * the URI object held by the IncomingRequest class to a path relative
+ * to the SCRIPT_NAME. If the baseURL contains subfolders, this value
+ * will be different from the current URI path.
+ *
  * @var string
  */
  protected $path;
@@ -232,9 +242,12 @@ public static function removeDotSegments(string $path): string
  /**
  * Constructor.
  *
- * @param string $uri
+ * @param string|null $uri The URI to parse.
+ *
+ * @throws HTTPException
  *
- * @throws InvalidArgumentException
+ * @TODO null for param $uri should be removed.
+ * See https://www.php-fig.org/psr/psr-17/#26-urifactoryinterface
  */
  public function __construct(?string $uri = null)
  {
@@ -273,6 +286,8 @@ public function useRawQueryString(bool $raw = true)
  * Sets and overwrites any current URI information.
  *
  * @return URI
+ *
+ * @throws HTTPException
  */
  public function setURI(?string $uri = null)
  {
@@ -744,6 +759,30 @@ public function setPath(string $path)
  return $this;
  }
 
+ /**
+ * Sets the current baseURL.
+ *
+ * @interal
+ */
+ public function setBaseURL(string $baseURL): void
+ {
+ $this->baseURL = $baseURL;
+ }
+
+ /**
+ * Returns the current baseURL.
+ *
+ * @interal
+ */
+ public function getBaseURL(): string
+ {
+ if ($this->baseURL === null) {
+ throw new BadMethodCallException('The $baseURL is not set.');
+ }
+
+ return $this->baseURL;
+ }
+
  /**
  * Sets the path portion of the URI based on segments.
  *

system/Helpers/url_helper.php

@@ -9,6 +9,8 @@
  * the LICENSE file that was distributed with this source code.
  */
 
+use CodeIgniter\HTTP\CLIRequest;
+use CodeIgniter\HTTP\Exceptions\HTTPException;
 use CodeIgniter\HTTP\IncomingRequest;
 use CodeIgniter\HTTP\URI;
 use CodeIgniter\Router\Exceptions\RouterException;
@@ -19,14 +21,15 @@
 
 if (! function_exists('_get_uri')) {
  /**
- * Used by the other URL functions to build a
- * framework-specific URI based on the App config.
+ * Used by the other URL functions to build a framework-specific URI
+ * based on $request->getUri()->getBaseURL() and the App config.
  *
- * @internal Outside of the framework this should not be used directly.
+ * @internal Outside the framework this should not be used directly.
  *
  * @param string $relativePath May include queries or fragments
  *
- * @throws InvalidArgumentException For invalid paths or config
+ * @throws HTTPException For invalid paths.
+ * @throws InvalidArgumentException For invalid config.
  */
  function _get_uri(string $relativePath = '', ?App $config = null): URI
  {
@@ -37,7 +40,7 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  }
 
  // If a full URI was passed then convert it
- if (is_int(strpos($relativePath, '://'))) {
+ if (strpos($relativePath, '://') !== false) {
  $full = new URI($relativePath);
  $relativePath = URI::createURIString(
  null,
@@ -51,7 +54,14 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  $relativePath = URI::removeDotSegments($relativePath);
 
  // Build the full URL based on $config and $relativePath
- $url = rtrim($config->baseURL, '/ ') . '/';
+ $request = Services::request();
+
+ if ($request instanceof CLIRequest) {
+ /** @var App $config */
+ $url = rtrim($config->baseURL, '/ ') . '/';
+ } else {
+ $url = $request->getUri()->getBaseURL();
+ }
 
  // Check for an index page
  if ($config->indexPage !== '') {

system/Test/Mock/MockIncomingRequest.php

@@ -15,8 +15,4 @@
 
 class MockIncomingRequest extends IncomingRequest
 {
- protected function detectURI($protocol, $baseURL)
- {
- // Do nothing...
- }
 }

tests/system/HTTP/RedirectResponseTest.php

@@ -40,6 +40,8 @@ protected function setUp(): void
  {
  parent::setUp();
 
+ $this->resetServices();
+
  $_SERVER['REQUEST_METHOD'] = 'GET';
 
  $this->config = new App();
@@ -48,7 +50,12 @@ protected function setUp(): void
  $this->routes = new RouteCollection(Services::locator(), new Modules());
  Services::injectMock('routes', $this->routes);
 
- $this->request = new MockIncomingRequest($this->config, new URI('http://example.com'), null, new UserAgent());
+ $this->request = new MockIncomingRequest(
+ $this->config,
+ new URI('http://example.com'),
+ null,
+ new UserAgent()
+ );
  Services::injectMock('request', $this->request);
  }
 

tests/system/HTTP/ResponseTest.php

@@ -34,9 +34,9 @@ protected function setUp(): void
  {
  $this->server = $_SERVER;
 
- Services::reset();
-
  parent::setUp();
+
+ $this->resetServices();
  }
 
  protected function tearDown(): void
@@ -164,6 +164,8 @@ public function testSetLink()
  $config->baseURL = 'http://example.com/test/';
  Factories::injectMock('config', 'App', $config);
 
+ $this->resetServices();
+
  $response = new Response($config);
  $pager = Services::pager();
 

tests/system/Helpers/URLHelper/CurrentUrlTest.php

@@ -58,12 +58,38 @@ protected function tearDown(): void
 
  public function testCurrentURLReturnsBasicURL()
  {
- // Since we're on a CLI, we must provide our own URI
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
  $this->config->baseURL = 'http://example.com/public';
 
  $this->assertSame('http://example.com/public/index.php/', current_url());
  }
 
+ public function testCurrentURLReturnsAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://www.example.jp/public/index.php/', current_url());
+ }
+
+ public function testCurrentURLReturnsBaseURLIfNotAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'invalid.example.org';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://example.com/public/index.php/', current_url());
+ }
+
  public function testCurrentURLReturnsObject()
  {
  // Since we're on a CLI, we must provide our own URI

tests/system/Helpers/URLHelper/SiteUrlTest.php

@@ -281,14 +281,49 @@ public function testBaseURLService()
  $_SERVER['HTTP_HOST'] = 'example.com';
  $_SERVER['REQUEST_URI'] = '/ci/v4/x/y';
 
- $uri = new URI('http://example.com/ci/v4/x/y');
- Services::injectMock('uri', $uri);
-
  $this->config->baseURL = 'http://example.com/ci/v4/';
  $request = Services::request($this->config);
  Services::injectMock('request', $request);
 
  $this->assertSame('http://example.com/ci/v4/index.php/controller/method', site_url('controller/method', null, $this->config));
  $this->assertSame('http://example.com/ci/v4/controller/method', base_url('controller/method', null));
  }
+
+ public function testSiteURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/index.php/controller/method',
+ site_url('controller/method', null, $this->config)
+ );
+ }
+
+ public function testBaseURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/controller/method',
+ base_url('controller/method', null)
+ );
+ }
 }

app/Config/App.php

@@ -24,6 +24,20 @@ class App extends BaseConfig
  */
  public string $baseURL = 'http://localhost:8080/';
 
+ /**
+ * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
+ * If you want to accept multiple Hostnames, set this.
+ *
+ * E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
+ * also accepts 'http://media.example.com/' and
+ * 'http://accounts.example.com/':
+ * ['media.example.com', 'accounts.example.com']
+ *
+ * @var string[]
+ * @phpstan-var list<string>
+ */
+ public array $allowedHostnames = [];
+
  /**
  * --------------------------------------------------------------------------
  * Index File

system/HTTP/IncomingRequest.php

@@ -192,14 +192,12 @@ public function detectLocale($config)
  * Sets up our URI object based on the information we have. This is
  * either provided by the user in the baseURL Config setting, or
  * determined from the environment as needed.
+ *
+ * @deprecated $protocol and $baseURL are deprecated. No longer used.
  */
  protected function detectURI(string $protocol, string $baseURL)
  {
- // Passing the config is unnecessary but left for legacy purposes
- $config = clone $this->config;
- $config->baseURL = $baseURL;
-
- $this->setPath($this->detectPath($protocol), $config);
+ $this->setPath($this->detectPath($this->config->uriProtocol), $this->config);
  }
 
  /**
@@ -270,7 +268,7 @@ protected function parseRequestURI(): string
  }
 
  // This section ensures that even on servers that require the URI to contain the query string (Nginx) a correct
- // URI is found, and also fixes the QUERY_STRING getServer var and $_GET array.
+ // URI is found, and also fixes the QUERY_STRING Server var and $_GET array.
  if (trim($uri, '/') === '' && strncmp($query, '/', 1) === 0) {
  $query = explode('?', $query, 2);
  $uri = $query[0];
@@ -400,19 +398,26 @@ public function setPath(string $path, ?App $config = null)
 
  // It's possible the user forgot a trailing slash on their
  // baseURL, so let's help them out.
- $baseURL = $config->baseURL === '' ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
+ $baseURL = ($config->baseURL === '') ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
 
- // Based on our baseURL provided by the developer
- // set our current domain name, scheme
+ // Based on our baseURL and allowedHostnames provided by the developer
+ // and HTTP_HOST, set our current domain name, scheme.
  if ($baseURL !== '') {
+ $host = $this->determineHost($config, $baseURL);
+
+ // Set URI::$baseURL
+ $uri = new URI($baseURL);
+ $currentBaseURL = (string) $uri->setHost($host);
+ $this->uri->setBaseURL($currentBaseURL);
+
  $this->uri->setScheme(parse_url($baseURL, PHP_URL_SCHEME));
- $this->uri->setHost(parse_url($baseURL, PHP_URL_HOST));
+ $this->uri->setHost($host);
  $this->uri->setPort(parse_url($baseURL, PHP_URL_PORT));
 
  // Ensure we have any query vars
  $this->uri->setQuery($_SERVER['QUERY_STRING'] ?? '');
 
- // Check if the baseURL scheme needs to be coerced into its secure version
+ // Check if the scheme needs to be coerced into its secure version
  if ($config->forceGlobalSecureRequests && $this->uri->getScheme() === 'http') {
  $this->uri->setScheme('https');
  }
@@ -425,6 +430,27 @@ public function setPath(string $path, ?App $config = null)
  return $this;
  }
 
+ private function determineHost(App $config, string $baseURL): string
+ {
+ $host = parse_url($baseURL, PHP_URL_HOST);
+
+ if (empty($config->allowedHostnames)) {
+ return $host;
+ }
+
+ // Update host if it is valid.
+ $httpHostPort = $this->getServer('HTTP_HOST');
+ if ($httpHostPort !== null) {
+ [$httpHost] = explode(':', $httpHostPort, 2);
+
+ if (in_array($httpHost, $config->allowedHostnames, true)) {
+ $host = $httpHost;
+ }
+ }
+
+ return $host;
+ }
+
  /**
  * Returns the path relative to SCRIPT_NAME,
  * running detection as necessary.

system/HTTP/URI.php

@@ -11,8 +11,8 @@
 
 namespace CodeIgniter\HTTP;
 
+use BadMethodCallException;
 use CodeIgniter\HTTP\Exceptions\HTTPException;
-use InvalidArgumentException;
 
 /**
  * Abstraction for a uniform resource identifier (URI).
@@ -36,6 +36,11 @@ class URI
  */
  protected $uriString;
 
+ /**
+ * The Current baseURL.
+ */
+ private ?string $baseURL = null;
+
  /**
  * List of URI segments.
  *
@@ -83,6 +88,11 @@ class URI
  /**
  * URI path.
  *
+ * Note: The constructor of the IncomingRequest class changes the path of
+ * the URI object held by the IncomingRequest class to a path relative
+ * to the SCRIPT_NAME. If the baseURL contains subfolders, this value
+ * will be different from the current URI path.
+ *
  * @var string
  */
  protected $path;
@@ -232,9 +242,12 @@ public static function removeDotSegments(string $path): string
  /**
  * Constructor.
  *
- * @param string $uri
+ * @param string|null $uri The URI to parse.
+ *
+ * @throws HTTPException
  *
- * @throws InvalidArgumentException
+ * @TODO null for param $uri should be removed.
+ * See https://www.php-fig.org/psr/psr-17/#26-urifactoryinterface
  */
  public function __construct(?string $uri = null)
  {
@@ -273,6 +286,8 @@ public function useRawQueryString(bool $raw = true)
  * Sets and overwrites any current URI information.
  *
  * @return URI
+ *
+ * @throws HTTPException
  */
  public function setURI(?string $uri = null)
  {
@@ -744,6 +759,30 @@ public function setPath(string $path)
  return $this;
  }
 
+ /**
+ * Sets the current baseURL.
+ *
+ * @interal
+ */
+ public function setBaseURL(string $baseURL): void
+ {
+ $this->baseURL = $baseURL;
+ }
+
+ /**
+ * Returns the current baseURL.
+ *
+ * @interal
+ */
+ public function getBaseURL(): string
+ {
+ if ($this->baseURL === null) {
+ throw new BadMethodCallException('The $baseURL is not set.');
+ }
+
+ return $this->baseURL;
+ }
+
  /**
  * Sets the path portion of the URI based on segments.
  *

system/Helpers/url_helper.php

@@ -9,6 +9,8 @@
  * the LICENSE file that was distributed with this source code.
  */
 
+use CodeIgniter\HTTP\CLIRequest;
+use CodeIgniter\HTTP\Exceptions\HTTPException;
 use CodeIgniter\HTTP\IncomingRequest;
 use CodeIgniter\HTTP\URI;
 use CodeIgniter\Router\Exceptions\RouterException;
@@ -19,14 +21,15 @@
 
 if (! function_exists('_get_uri')) {
  /**
- * Used by the other URL functions to build a
- * framework-specific URI based on the App config.
+ * Used by the other URL functions to build a framework-specific URI
+ * based on $request->getUri()->getBaseURL() and the App config.
  *
- * @internal Outside of the framework this should not be used directly.
+ * @internal Outside the framework this should not be used directly.
  *
  * @param string $relativePath May include queries or fragments
  *
- * @throws InvalidArgumentException For invalid paths or config
+ * @throws HTTPException For invalid paths.
+ * @throws InvalidArgumentException For invalid config.
  */
  function _get_uri(string $relativePath = '', ?App $config = null): URI
  {
@@ -37,7 +40,7 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  }
 
  // If a full URI was passed then convert it
- if (is_int(strpos($relativePath, '://'))) {
+ if (strpos($relativePath, '://') !== false) {
  $full = new URI($relativePath);
  $relativePath = URI::createURIString(
  null,
@@ -51,7 +54,14 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  $relativePath = URI::removeDotSegments($relativePath);
 
  // Build the full URL based on $config and $relativePath
- $url = rtrim($config->baseURL, '/ ') . '/';
+ $request = Services::request();
+
+ if ($request instanceof CLIRequest) {
+ /** @var App $config */
+ $url = rtrim($config->baseURL, '/ ') . '/';
+ } else {
+ $url = $request->getUri()->getBaseURL();
+ }
 
  // Check for an index page
  if ($config->indexPage !== '') {

system/Test/Mock/MockIncomingRequest.php

@@ -15,8 +15,4 @@
 
 class MockIncomingRequest extends IncomingRequest
 {
- protected function detectURI($protocol, $baseURL)
- {
- // Do nothing...
- }
 }

tests/system/HTTP/RedirectResponseTest.php

@@ -40,6 +40,8 @@ protected function setUp(): void
  {
  parent::setUp();
 
+ $this->resetServices();
+
  $_SERVER['REQUEST_METHOD'] = 'GET';
 
  $this->config = new App();
@@ -48,7 +50,12 @@ protected function setUp(): void
  $this->routes = new RouteCollection(Services::locator(), new Modules());
  Services::injectMock('routes', $this->routes);
 
- $this->request = new MockIncomingRequest($this->config, new URI('http://example.com'), null, new UserAgent());
+ $this->request = new MockIncomingRequest(
+ $this->config,
+ new URI('http://example.com'),
+ null,
+ new UserAgent()
+ );
  Services::injectMock('request', $this->request);
  }
 

tests/system/HTTP/ResponseTest.php

@@ -34,9 +34,9 @@ protected function setUp(): void
  {
  $this->server = $_SERVER;
 
- Services::reset();
-
  parent::setUp();
+
+ $this->resetServices();
  }
 
  protected function tearDown(): void
@@ -164,6 +164,8 @@ public function testSetLink()
  $config->baseURL = 'http://example.com/test/';
  Factories::injectMock('config', 'App', $config);
 
+ $this->resetServices();
+
  $response = new Response($config);
  $pager = Services::pager();
 

tests/system/Helpers/URLHelper/CurrentUrlTest.php

@@ -58,12 +58,38 @@ protected function tearDown(): void
 
  public function testCurrentURLReturnsBasicURL()
  {
- // Since we're on a CLI, we must provide our own URI
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
  $this->config->baseURL = 'http://example.com/public';
 
  $this->assertSame('http://example.com/public/index.php/', current_url());
  }
 
+ public function testCurrentURLReturnsAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://www.example.jp/public/index.php/', current_url());
+ }
+
+ public function testCurrentURLReturnsBaseURLIfNotAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'invalid.example.org';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://example.com/public/index.php/', current_url());
+ }
+
  public function testCurrentURLReturnsObject()
  {
  // Since we're on a CLI, we must provide our own URI

tests/system/Helpers/URLHelper/SiteUrlTest.php

@@ -281,14 +281,49 @@ public function testBaseURLService()
  $_SERVER['HTTP_HOST'] = 'example.com';
  $_SERVER['REQUEST_URI'] = '/ci/v4/x/y';
 
- $uri = new URI('http://example.com/ci/v4/x/y');
- Services::injectMock('uri', $uri);
-
  $this->config->baseURL = 'http://example.com/ci/v4/';
  $request = Services::request($this->config);
  Services::injectMock('request', $request);
 
  $this->assertSame('http://example.com/ci/v4/index.php/controller/method', site_url('controller/method', null, $this->config));
  $this->assertSame('http://example.com/ci/v4/controller/method', base_url('controller/method', null));
  }
+
+ public function testSiteURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/index.php/controller/method',
+ site_url('controller/method', null, $this->config)
+ );
+ }
+
+ public function testBaseURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/controller/method',
+ base_url('controller/method', null)
+ );
+ }
 }

app/Config/App.php

@@ -24,6 +24,20 @@ class App extends BaseConfig
  */
  public string $baseURL = 'http://localhost:8080/';
 
+ /**
+ * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
+ * If you want to accept multiple Hostnames, set this.
+ *
+ * E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
+ * also accepts 'http://media.example.com/' and
+ * 'http://accounts.example.com/':
+ * ['media.example.com', 'accounts.example.com']
+ *
+ * @var string[]
+ * @phpstan-var list<string>
+ */
+ public array $allowedHostnames = [];
+
  /**
  * --------------------------------------------------------------------------
  * Index File

system/HTTP/IncomingRequest.php

@@ -192,14 +192,12 @@ public function detectLocale($config)
  * Sets up our URI object based on the information we have. This is
  * either provided by the user in the baseURL Config setting, or
  * determined from the environment as needed.
+ *
+ * @deprecated $protocol and $baseURL are deprecated. No longer used.
  */
  protected function detectURI(string $protocol, string $baseURL)
  {
- // Passing the config is unnecessary but left for legacy purposes
- $config = clone $this->config;
- $config->baseURL = $baseURL;
-
- $this->setPath($this->detectPath($protocol), $config);
+ $this->setPath($this->detectPath($this->config->uriProtocol), $this->config);
  }
 
  /**
@@ -270,7 +268,7 @@ protected function parseRequestURI(): string
  }
 
  // This section ensures that even on servers that require the URI to contain the query string (Nginx) a correct
- // URI is found, and also fixes the QUERY_STRING getServer var and $_GET array.
+ // URI is found, and also fixes the QUERY_STRING Server var and $_GET array.
  if (trim($uri, '/') === '' && strncmp($query, '/', 1) === 0) {
  $query = explode('?', $query, 2);
  $uri = $query[0];
@@ -400,19 +398,26 @@ public function setPath(string $path, ?App $config = null)
 
  // It's possible the user forgot a trailing slash on their
  // baseURL, so let's help them out.
- $baseURL = $config->baseURL === '' ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
+ $baseURL = ($config->baseURL === '') ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
 
- // Based on our baseURL provided by the developer
- // set our current domain name, scheme
+ // Based on our baseURL and allowedHostnames provided by the developer
+ // and HTTP_HOST, set our current domain name, scheme.
  if ($baseURL !== '') {
+ $host = $this->determineHost($config, $baseURL);
+
+ // Set URI::$baseURL
+ $uri = new URI($baseURL);
+ $currentBaseURL = (string) $uri->setHost($host);
+ $this->uri->setBaseURL($currentBaseURL);
+
  $this->uri->setScheme(parse_url($baseURL, PHP_URL_SCHEME));
- $this->uri->setHost(parse_url($baseURL, PHP_URL_HOST));
+ $this->uri->setHost($host);
  $this->uri->setPort(parse_url($baseURL, PHP_URL_PORT));
 
  // Ensure we have any query vars
  $this->uri->setQuery($_SERVER['QUERY_STRING'] ?? '');
 
- // Check if the baseURL scheme needs to be coerced into its secure version
+ // Check if the scheme needs to be coerced into its secure version
  if ($config->forceGlobalSecureRequests && $this->uri->getScheme() === 'http') {
  $this->uri->setScheme('https');
  }
@@ -425,6 +430,27 @@ public function setPath(string $path, ?App $config = null)
  return $this;
  }
 
+ private function determineHost(App $config, string $baseURL): string
+ {
+ $host = parse_url($baseURL, PHP_URL_HOST);
+
+ if (empty($config->allowedHostnames)) {
+ return $host;
+ }
+
+ // Update host if it is valid.
+ $httpHostPort = $this->getServer('HTTP_HOST');
+ if ($httpHostPort !== null) {
+ [$httpHost] = explode(':', $httpHostPort, 2);
+
+ if (in_array($httpHost, $config->allowedHostnames, true)) {
+ $host = $httpHost;
+ }
+ }
+
+ return $host;
+ }
+
  /**
  * Returns the path relative to SCRIPT_NAME,
  * running detection as necessary.

system/HTTP/URI.php

@@ -11,8 +11,8 @@
 
 namespace CodeIgniter\HTTP;
 
+use BadMethodCallException;
 use CodeIgniter\HTTP\Exceptions\HTTPException;
-use InvalidArgumentException;
 
 /**
  * Abstraction for a uniform resource identifier (URI).
@@ -36,6 +36,11 @@ class URI
  */
  protected $uriString;
 
+ /**
+ * The Current baseURL.
+ */
+ private ?string $baseURL = null;
+
  /**
  * List of URI segments.
  *
@@ -83,6 +88,11 @@ class URI
  /**
  * URI path.
  *
+ * Note: The constructor of the IncomingRequest class changes the path of
+ * the URI object held by the IncomingRequest class to a path relative
+ * to the SCRIPT_NAME. If the baseURL contains subfolders, this value
+ * will be different from the current URI path.
+ *
  * @var string
  */
  protected $path;
@@ -232,9 +242,12 @@ public static function removeDotSegments(string $path): string
  /**
  * Constructor.
  *
- * @param string $uri
+ * @param string|null $uri The URI to parse.
+ *
+ * @throws HTTPException
  *
- * @throws InvalidArgumentException
+ * @TODO null for param $uri should be removed.
+ * See https://www.php-fig.org/psr/psr-17/#26-urifactoryinterface
  */
  public function __construct(?string $uri = null)
  {
@@ -273,6 +286,8 @@ public function useRawQueryString(bool $raw = true)
  * Sets and overwrites any current URI information.
  *
  * @return URI
+ *
+ * @throws HTTPException
  */
  public function setURI(?string $uri = null)
  {
@@ -744,6 +759,30 @@ public function setPath(string $path)
  return $this;
  }
 
+ /**
+ * Sets the current baseURL.
+ *
+ * @interal
+ */
+ public function setBaseURL(string $baseURL): void
+ {
+ $this->baseURL = $baseURL;
+ }
+
+ /**
+ * Returns the current baseURL.
+ *
+ * @interal
+ */
+ public function getBaseURL(): string
+ {
+ if ($this->baseURL === null) {
+ throw new BadMethodCallException('The $baseURL is not set.');
+ }
+
+ return $this->baseURL;
+ }
+
  /**
  * Sets the path portion of the URI based on segments.
  *

system/Helpers/url_helper.php

@@ -9,6 +9,8 @@
  * the LICENSE file that was distributed with this source code.
  */
 
+use CodeIgniter\HTTP\CLIRequest;
+use CodeIgniter\HTTP\Exceptions\HTTPException;
 use CodeIgniter\HTTP\IncomingRequest;
 use CodeIgniter\HTTP\URI;
 use CodeIgniter\Router\Exceptions\RouterException;
@@ -19,14 +21,15 @@
 
 if (! function_exists('_get_uri')) {
  /**
- * Used by the other URL functions to build a
- * framework-specific URI based on the App config.
+ * Used by the other URL functions to build a framework-specific URI
+ * based on $request->getUri()->getBaseURL() and the App config.
  *
- * @internal Outside of the framework this should not be used directly.
+ * @internal Outside the framework this should not be used directly.
  *
  * @param string $relativePath May include queries or fragments
  *
- * @throws InvalidArgumentException For invalid paths or config
+ * @throws HTTPException For invalid paths.
+ * @throws InvalidArgumentException For invalid config.
  */
  function _get_uri(string $relativePath = '', ?App $config = null): URI
  {
@@ -37,7 +40,7 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  }
 
  // If a full URI was passed then convert it
- if (is_int(strpos($relativePath, '://'))) {
+ if (strpos($relativePath, '://') !== false) {
  $full = new URI($relativePath);
  $relativePath = URI::createURIString(
  null,
@@ -51,7 +54,14 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  $relativePath = URI::removeDotSegments($relativePath);
 
  // Build the full URL based on $config and $relativePath
- $url = rtrim($config->baseURL, '/ ') . '/';
+ $request = Services::request();
+
+ if ($request instanceof CLIRequest) {
+ /** @var App $config */
+ $url = rtrim($config->baseURL, '/ ') . '/';
+ } else {
+ $url = $request->getUri()->getBaseURL();
+ }
 
  // Check for an index page
  if ($config->indexPage !== '') {

system/Test/Mock/MockIncomingRequest.php

@@ -15,8 +15,4 @@
 
 class MockIncomingRequest extends IncomingRequest
 {
- protected function detectURI($protocol, $baseURL)
- {
- // Do nothing...
- }
 }

tests/system/HTTP/RedirectResponseTest.php

@@ -40,6 +40,8 @@ protected function setUp(): void
  {
  parent::setUp();
 
+ $this->resetServices();
+
  $_SERVER['REQUEST_METHOD'] = 'GET';
 
  $this->config = new App();
@@ -48,7 +50,12 @@ protected function setUp(): void
  $this->routes = new RouteCollection(Services::locator(), new Modules());
  Services::injectMock('routes', $this->routes);
 
- $this->request = new MockIncomingRequest($this->config, new URI('http://example.com'), null, new UserAgent());
+ $this->request = new MockIncomingRequest(
+ $this->config,
+ new URI('http://example.com'),
+ null,
+ new UserAgent()
+ );
  Services::injectMock('request', $this->request);
  }
 

tests/system/HTTP/ResponseTest.php

@@ -34,9 +34,9 @@ protected function setUp(): void
  {
  $this->server = $_SERVER;
 
- Services::reset();
-
  parent::setUp();
+
+ $this->resetServices();
  }
 
  protected function tearDown(): void
@@ -164,6 +164,8 @@ public function testSetLink()
  $config->baseURL = 'http://example.com/test/';
  Factories::injectMock('config', 'App', $config);
 
+ $this->resetServices();
+
  $response = new Response($config);
  $pager = Services::pager();
 

tests/system/Helpers/URLHelper/CurrentUrlTest.php

@@ -58,12 +58,38 @@ protected function tearDown(): void
 
  public function testCurrentURLReturnsBasicURL()
  {
- // Since we're on a CLI, we must provide our own URI
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
  $this->config->baseURL = 'http://example.com/public';
 
  $this->assertSame('http://example.com/public/index.php/', current_url());
  }
 
+ public function testCurrentURLReturnsAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://www.example.jp/public/index.php/', current_url());
+ }
+
+ public function testCurrentURLReturnsBaseURLIfNotAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'invalid.example.org';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://example.com/public/index.php/', current_url());
+ }
+
  public function testCurrentURLReturnsObject()
  {
  // Since we're on a CLI, we must provide our own URI

tests/system/Helpers/URLHelper/SiteUrlTest.php

@@ -281,14 +281,49 @@ public function testBaseURLService()
  $_SERVER['HTTP_HOST'] = 'example.com';
  $_SERVER['REQUEST_URI'] = '/ci/v4/x/y';
 
- $uri = new URI('http://example.com/ci/v4/x/y');
- Services::injectMock('uri', $uri);
-
  $this->config->baseURL = 'http://example.com/ci/v4/';
  $request = Services::request($this->config);
  Services::injectMock('request', $request);
 
  $this->assertSame('http://example.com/ci/v4/index.php/controller/method', site_url('controller/method', null, $this->config));
  $this->assertSame('http://example.com/ci/v4/controller/method', base_url('controller/method', null));
  }
+
+ public function testSiteURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/index.php/controller/method',
+ site_url('controller/method', null, $this->config)
+ );
+ }
+
+ public function testBaseURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/controller/method',
+ base_url('controller/method', null)
+ );
+ }
 }

app/Config/App.php

@@ -24,6 +24,20 @@ class App extends BaseConfig
  */
  public string $baseURL = 'http://localhost:8080/';
 
+ /**
+ * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
+ * If you want to accept multiple Hostnames, set this.
+ *
+ * E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
+ * also accepts 'http://media.example.com/' and
+ * 'http://accounts.example.com/':
+ * ['media.example.com', 'accounts.example.com']
+ *
+ * @var string[]
+ * @phpstan-var list<string>
+ */
+ public array $allowedHostnames = [];
+
  /**
  * --------------------------------------------------------------------------
  * Index File

system/HTTP/IncomingRequest.php

@@ -192,14 +192,12 @@ public function detectLocale($config)
  * Sets up our URI object based on the information we have. This is
  * either provided by the user in the baseURL Config setting, or
  * determined from the environment as needed.
+ *
+ * @deprecated $protocol and $baseURL are deprecated. No longer used.
  */
  protected function detectURI(string $protocol, string $baseURL)
  {
- // Passing the config is unnecessary but left for legacy purposes
- $config = clone $this->config;
- $config->baseURL = $baseURL;
-
- $this->setPath($this->detectPath($protocol), $config);
+ $this->setPath($this->detectPath($this->config->uriProtocol), $this->config);
  }
 
  /**
@@ -270,7 +268,7 @@ protected function parseRequestURI(): string
  }
 
  // This section ensures that even on servers that require the URI to contain the query string (Nginx) a correct
- // URI is found, and also fixes the QUERY_STRING getServer var and $_GET array.
+ // URI is found, and also fixes the QUERY_STRING Server var and $_GET array.
  if (trim($uri, '/') === '' && strncmp($query, '/', 1) === 0) {
  $query = explode('?', $query, 2);
  $uri = $query[0];
@@ -400,19 +398,26 @@ public function setPath(string $path, ?App $config = null)
 
  // It's possible the user forgot a trailing slash on their
  // baseURL, so let's help them out.
- $baseURL = $config->baseURL === '' ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
+ $baseURL = ($config->baseURL === '') ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
 
- // Based on our baseURL provided by the developer
- // set our current domain name, scheme
+ // Based on our baseURL and allowedHostnames provided by the developer
+ // and HTTP_HOST, set our current domain name, scheme.
  if ($baseURL !== '') {
+ $host = $this->determineHost($config, $baseURL);
+
+ // Set URI::$baseURL
+ $uri = new URI($baseURL);
+ $currentBaseURL = (string) $uri->setHost($host);
+ $this->uri->setBaseURL($currentBaseURL);
+
  $this->uri->setScheme(parse_url($baseURL, PHP_URL_SCHEME));
- $this->uri->setHost(parse_url($baseURL, PHP_URL_HOST));
+ $this->uri->setHost($host);
  $this->uri->setPort(parse_url($baseURL, PHP_URL_PORT));
 
  // Ensure we have any query vars
  $this->uri->setQuery($_SERVER['QUERY_STRING'] ?? '');
 
- // Check if the baseURL scheme needs to be coerced into its secure version
+ // Check if the scheme needs to be coerced into its secure version
  if ($config->forceGlobalSecureRequests && $this->uri->getScheme() === 'http') {
  $this->uri->setScheme('https');
  }
@@ -425,6 +430,27 @@ public function setPath(string $path, ?App $config = null)
  return $this;
  }
 
+ private function determineHost(App $config, string $baseURL): string
+ {
+ $host = parse_url($baseURL, PHP_URL_HOST);
+
+ if (empty($config->allowedHostnames)) {
+ return $host;
+ }
+
+ // Update host if it is valid.
+ $httpHostPort = $this->getServer('HTTP_HOST');
+ if ($httpHostPort !== null) {
+ [$httpHost] = explode(':', $httpHostPort, 2);
+
+ if (in_array($httpHost, $config->allowedHostnames, true)) {
+ $host = $httpHost;
+ }
+ }
+
+ return $host;
+ }
+
  /**
  * Returns the path relative to SCRIPT_NAME,
  * running detection as necessary.

system/HTTP/URI.php

@@ -11,8 +11,8 @@
 
 namespace CodeIgniter\HTTP;
 
+use BadMethodCallException;
 use CodeIgniter\HTTP\Exceptions\HTTPException;
-use InvalidArgumentException;
 
 /**
  * Abstraction for a uniform resource identifier (URI).
@@ -36,6 +36,11 @@ class URI
  */
  protected $uriString;
 
+ /**
+ * The Current baseURL.
+ */
+ private ?string $baseURL = null;
+
  /**
  * List of URI segments.
  *
@@ -83,6 +88,11 @@ class URI
  /**
  * URI path.
  *
+ * Note: The constructor of the IncomingRequest class changes the path of
+ * the URI object held by the IncomingRequest class to a path relative
+ * to the SCRIPT_NAME. If the baseURL contains subfolders, this value
+ * will be different from the current URI path.
+ *
  * @var string
  */
  protected $path;
@@ -232,9 +242,12 @@ public static function removeDotSegments(string $path): string
  /**
  * Constructor.
  *
- * @param string $uri
+ * @param string|null $uri The URI to parse.
+ *
+ * @throws HTTPException
  *
- * @throws InvalidArgumentException
+ * @TODO null for param $uri should be removed.
+ * See https://www.php-fig.org/psr/psr-17/#26-urifactoryinterface
  */
  public function __construct(?string $uri = null)
  {
@@ -273,6 +286,8 @@ public function useRawQueryString(bool $raw = true)
  * Sets and overwrites any current URI information.
  *
  * @return URI
+ *
+ * @throws HTTPException
  */
  public function setURI(?string $uri = null)
  {
@@ -744,6 +759,30 @@ public function setPath(string $path)
  return $this;
  }
 
+ /**
+ * Sets the current baseURL.
+ *
+ * @interal
+ */
+ public function setBaseURL(string $baseURL): void
+ {
+ $this->baseURL = $baseURL;
+ }
+
+ /**
+ * Returns the current baseURL.
+ *
+ * @interal
+ */
+ public function getBaseURL(): string
+ {
+ if ($this->baseURL === null) {
+ throw new BadMethodCallException('The $baseURL is not set.');
+ }
+
+ return $this->baseURL;
+ }
+
  /**
  * Sets the path portion of the URI based on segments.
  *

system/Helpers/url_helper.php

@@ -9,6 +9,8 @@
  * the LICENSE file that was distributed with this source code.
  */
 
+use CodeIgniter\HTTP\CLIRequest;
+use CodeIgniter\HTTP\Exceptions\HTTPException;
 use CodeIgniter\HTTP\IncomingRequest;
 use CodeIgniter\HTTP\URI;
 use CodeIgniter\Router\Exceptions\RouterException;
@@ -19,14 +21,15 @@
 
 if (! function_exists('_get_uri')) {
  /**
- * Used by the other URL functions to build a
- * framework-specific URI based on the App config.
+ * Used by the other URL functions to build a framework-specific URI
+ * based on $request->getUri()->getBaseURL() and the App config.
  *
- * @internal Outside of the framework this should not be used directly.
+ * @internal Outside the framework this should not be used directly.
  *
  * @param string $relativePath May include queries or fragments
  *
- * @throws InvalidArgumentException For invalid paths or config
+ * @throws HTTPException For invalid paths.
+ * @throws InvalidArgumentException For invalid config.
  */
  function _get_uri(string $relativePath = '', ?App $config = null): URI
  {
@@ -37,7 +40,7 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  }
 
  // If a full URI was passed then convert it
- if (is_int(strpos($relativePath, '://'))) {
+ if (strpos($relativePath, '://') !== false) {
  $full = new URI($relativePath);
  $relativePath = URI::createURIString(
  null,
@@ -51,7 +54,14 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  $relativePath = URI::removeDotSegments($relativePath);
 
  // Build the full URL based on $config and $relativePath
- $url = rtrim($config->baseURL, '/ ') . '/';
+ $request = Services::request();
+
+ if ($request instanceof CLIRequest) {
+ /** @var App $config */
+ $url = rtrim($config->baseURL, '/ ') . '/';
+ } else {
+ $url = $request->getUri()->getBaseURL();
+ }
 
  // Check for an index page
  if ($config->indexPage !== '') {

system/Test/Mock/MockIncomingRequest.php

@@ -15,8 +15,4 @@
 
 class MockIncomingRequest extends IncomingRequest
 {
- protected function detectURI($protocol, $baseURL)
- {
- // Do nothing...
- }
 }

tests/system/HTTP/RedirectResponseTest.php

@@ -40,6 +40,8 @@ protected function setUp(): void
  {
  parent::setUp();
 
+ $this->resetServices();
+
  $_SERVER['REQUEST_METHOD'] = 'GET';
 
  $this->config = new App();
@@ -48,7 +50,12 @@ protected function setUp(): void
  $this->routes = new RouteCollection(Services::locator(), new Modules());
  Services::injectMock('routes', $this->routes);
 
- $this->request = new MockIncomingRequest($this->config, new URI('http://example.com'), null, new UserAgent());
+ $this->request = new MockIncomingRequest(
+ $this->config,
+ new URI('http://example.com'),
+ null,
+ new UserAgent()
+ );
  Services::injectMock('request', $this->request);
  }
 

tests/system/HTTP/ResponseTest.php

@@ -34,9 +34,9 @@ protected function setUp(): void
  {
  $this->server = $_SERVER;
 
- Services::reset();
-
  parent::setUp();
+
+ $this->resetServices();
  }
 
  protected function tearDown(): void
@@ -164,6 +164,8 @@ public function testSetLink()
  $config->baseURL = 'http://example.com/test/';
  Factories::injectMock('config', 'App', $config);
 
+ $this->resetServices();
+
  $response = new Response($config);
  $pager = Services::pager();
 

tests/system/Helpers/URLHelper/CurrentUrlTest.php

@@ -58,12 +58,38 @@ protected function tearDown(): void
 
  public function testCurrentURLReturnsBasicURL()
  {
- // Since we're on a CLI, we must provide our own URI
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
  $this->config->baseURL = 'http://example.com/public';
 
  $this->assertSame('http://example.com/public/index.php/', current_url());
  }
 
+ public function testCurrentURLReturnsAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://www.example.jp/public/index.php/', current_url());
+ }
+
+ public function testCurrentURLReturnsBaseURLIfNotAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'invalid.example.org';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://example.com/public/index.php/', current_url());
+ }
+
  public function testCurrentURLReturnsObject()
  {
  // Since we're on a CLI, we must provide our own URI

tests/system/Helpers/URLHelper/SiteUrlTest.php

@@ -281,14 +281,49 @@ public function testBaseURLService()
  $_SERVER['HTTP_HOST'] = 'example.com';
  $_SERVER['REQUEST_URI'] = '/ci/v4/x/y';
 
- $uri = new URI('http://example.com/ci/v4/x/y');
- Services::injectMock('uri', $uri);
-
  $this->config->baseURL = 'http://example.com/ci/v4/';
  $request = Services::request($this->config);
  Services::injectMock('request', $request);
 
  $this->assertSame('http://example.com/ci/v4/index.php/controller/method', site_url('controller/method', null, $this->config));
  $this->assertSame('http://example.com/ci/v4/controller/method', base_url('controller/method', null));
  }
+
+ public function testSiteURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/index.php/controller/method',
+ site_url('controller/method', null, $this->config)
+ );
+ }
+
+ public function testBaseURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/controller/method',
+ base_url('controller/method', null)
+ );
+ }
 }

app/Config/App.php

@@ -24,6 +24,20 @@ class App extends BaseConfig
  */
  public string $baseURL = 'http://localhost:8080/';
 
+ /**
+ * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
+ * If you want to accept multiple Hostnames, set this.
+ *
+ * E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
+ * also accepts 'http://media.example.com/' and
+ * 'http://accounts.example.com/':
+ * ['media.example.com', 'accounts.example.com']
+ *
+ * @var string[]
+ * @phpstan-var list<string>
+ */
+ public array $allowedHostnames = [];
+
  /**
  * --------------------------------------------------------------------------
  * Index File

system/HTTP/IncomingRequest.php

@@ -192,14 +192,12 @@ public function detectLocale($config)
  * Sets up our URI object based on the information we have. This is
  * either provided by the user in the baseURL Config setting, or
  * determined from the environment as needed.
+ *
+ * @deprecated $protocol and $baseURL are deprecated. No longer used.
  */
  protected function detectURI(string $protocol, string $baseURL)
  {
- // Passing the config is unnecessary but left for legacy purposes
- $config = clone $this->config;
- $config->baseURL = $baseURL;
-
- $this->setPath($this->detectPath($protocol), $config);
+ $this->setPath($this->detectPath($this->config->uriProtocol), $this->config);
  }
 
  /**
@@ -270,7 +268,7 @@ protected function parseRequestURI(): string
  }
 
  // This section ensures that even on servers that require the URI to contain the query string (Nginx) a correct
- // URI is found, and also fixes the QUERY_STRING getServer var and $_GET array.
+ // URI is found, and also fixes the QUERY_STRING Server var and $_GET array.
  if (trim($uri, '/') === '' && strncmp($query, '/', 1) === 0) {
  $query = explode('?', $query, 2);
  $uri = $query[0];
@@ -400,19 +398,26 @@ public function setPath(string $path, ?App $config = null)
 
  // It's possible the user forgot a trailing slash on their
  // baseURL, so let's help them out.
- $baseURL = $config->baseURL === '' ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
+ $baseURL = ($config->baseURL === '') ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
 
- // Based on our baseURL provided by the developer
- // set our current domain name, scheme
+ // Based on our baseURL and allowedHostnames provided by the developer
+ // and HTTP_HOST, set our current domain name, scheme.
  if ($baseURL !== '') {
+ $host = $this->determineHost($config, $baseURL);
+
+ // Set URI::$baseURL
+ $uri = new URI($baseURL);
+ $currentBaseURL = (string) $uri->setHost($host);
+ $this->uri->setBaseURL($currentBaseURL);
+
  $this->uri->setScheme(parse_url($baseURL, PHP_URL_SCHEME));
- $this->uri->setHost(parse_url($baseURL, PHP_URL_HOST));
+ $this->uri->setHost($host);
  $this->uri->setPort(parse_url($baseURL, PHP_URL_PORT));
 
  // Ensure we have any query vars
  $this->uri->setQuery($_SERVER['QUERY_STRING'] ?? '');
 
- // Check if the baseURL scheme needs to be coerced into its secure version
+ // Check if the scheme needs to be coerced into its secure version
  if ($config->forceGlobalSecureRequests && $this->uri->getScheme() === 'http') {
  $this->uri->setScheme('https');
  }
@@ -425,6 +430,27 @@ public function setPath(string $path, ?App $config = null)
  return $this;
  }
 
+ private function determineHost(App $config, string $baseURL): string
+ {
+ $host = parse_url($baseURL, PHP_URL_HOST);
+
+ if (empty($config->allowedHostnames)) {
+ return $host;
+ }
+
+ // Update host if it is valid.
+ $httpHostPort = $this->getServer('HTTP_HOST');
+ if ($httpHostPort !== null) {
+ [$httpHost] = explode(':', $httpHostPort, 2);
+
+ if (in_array($httpHost, $config->allowedHostnames, true)) {
+ $host = $httpHost;
+ }
+ }
+
+ return $host;
+ }
+
  /**
  * Returns the path relative to SCRIPT_NAME,
  * running detection as necessary.

system/HTTP/URI.php

@@ -11,8 +11,8 @@
 
 namespace CodeIgniter\HTTP;
 
+use BadMethodCallException;
 use CodeIgniter\HTTP\Exceptions\HTTPException;
-use InvalidArgumentException;
 
 /**
  * Abstraction for a uniform resource identifier (URI).
@@ -36,6 +36,11 @@ class URI
  */
  protected $uriString;
 
+ /**
+ * The Current baseURL.
+ */
+ private ?string $baseURL = null;
+
  /**
  * List of URI segments.
  *
@@ -83,6 +88,11 @@ class URI
  /**
  * URI path.
  *
+ * Note: The constructor of the IncomingRequest class changes the path of
+ * the URI object held by the IncomingRequest class to a path relative
+ * to the SCRIPT_NAME. If the baseURL contains subfolders, this value
+ * will be different from the current URI path.
+ *
  * @var string
  */
  protected $path;
@@ -232,9 +242,12 @@ public static function removeDotSegments(string $path): string
  /**
  * Constructor.
  *
- * @param string $uri
+ * @param string|null $uri The URI to parse.
+ *
+ * @throws HTTPException
  *
- * @throws InvalidArgumentException
+ * @TODO null for param $uri should be removed.
+ * See https://www.php-fig.org/psr/psr-17/#26-urifactoryinterface
  */
  public function __construct(?string $uri = null)
  {
@@ -273,6 +286,8 @@ public function useRawQueryString(bool $raw = true)
  * Sets and overwrites any current URI information.
  *
  * @return URI
+ *
+ * @throws HTTPException
  */
  public function setURI(?string $uri = null)
  {
@@ -744,6 +759,30 @@ public function setPath(string $path)
  return $this;
  }
 
+ /**
+ * Sets the current baseURL.
+ *
+ * @interal
+ */
+ public function setBaseURL(string $baseURL): void
+ {
+ $this->baseURL = $baseURL;
+ }
+
+ /**
+ * Returns the current baseURL.
+ *
+ * @interal
+ */
+ public function getBaseURL(): string
+ {
+ if ($this->baseURL === null) {
+ throw new BadMethodCallException('The $baseURL is not set.');
+ }
+
+ return $this->baseURL;
+ }
+
  /**
  * Sets the path portion of the URI based on segments.
  *

system/Helpers/url_helper.php

@@ -9,6 +9,8 @@
  * the LICENSE file that was distributed with this source code.
  */
 
+use CodeIgniter\HTTP\CLIRequest;
+use CodeIgniter\HTTP\Exceptions\HTTPException;
 use CodeIgniter\HTTP\IncomingRequest;
 use CodeIgniter\HTTP\URI;
 use CodeIgniter\Router\Exceptions\RouterException;
@@ -19,14 +21,15 @@
 
 if (! function_exists('_get_uri')) {
  /**
- * Used by the other URL functions to build a
- * framework-specific URI based on the App config.
+ * Used by the other URL functions to build a framework-specific URI
+ * based on $request->getUri()->getBaseURL() and the App config.
  *
- * @internal Outside of the framework this should not be used directly.
+ * @internal Outside the framework this should not be used directly.
  *
  * @param string $relativePath May include queries or fragments
  *
- * @throws InvalidArgumentException For invalid paths or config
+ * @throws HTTPException For invalid paths.
+ * @throws InvalidArgumentException For invalid config.
  */
  function _get_uri(string $relativePath = '', ?App $config = null): URI
  {
@@ -37,7 +40,7 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  }
 
  // If a full URI was passed then convert it
- if (is_int(strpos($relativePath, '://'))) {
+ if (strpos($relativePath, '://') !== false) {
  $full = new URI($relativePath);
  $relativePath = URI::createURIString(
  null,
@@ -51,7 +54,14 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  $relativePath = URI::removeDotSegments($relativePath);
 
  // Build the full URL based on $config and $relativePath
- $url = rtrim($config->baseURL, '/ ') . '/';
+ $request = Services::request();
+
+ if ($request instanceof CLIRequest) {
+ /** @var App $config */
+ $url = rtrim($config->baseURL, '/ ') . '/';
+ } else {
+ $url = $request->getUri()->getBaseURL();
+ }
 
  // Check for an index page
  if ($config->indexPage !== '') {

system/Test/Mock/MockIncomingRequest.php

@@ -15,8 +15,4 @@
 
 class MockIncomingRequest extends IncomingRequest
 {
- protected function detectURI($protocol, $baseURL)
- {
- // Do nothing...
- }
 }

tests/system/HTTP/RedirectResponseTest.php

@@ -40,6 +40,8 @@ protected function setUp(): void
  {
  parent::setUp();
 
+ $this->resetServices();
+
  $_SERVER['REQUEST_METHOD'] = 'GET';
 
  $this->config = new App();
@@ -48,7 +50,12 @@ protected function setUp(): void
  $this->routes = new RouteCollection(Services::locator(), new Modules());
  Services::injectMock('routes', $this->routes);
 
- $this->request = new MockIncomingRequest($this->config, new URI('http://example.com'), null, new UserAgent());
+ $this->request = new MockIncomingRequest(
+ $this->config,
+ new URI('http://example.com'),
+ null,
+ new UserAgent()
+ );
  Services::injectMock('request', $this->request);
  }
 

tests/system/HTTP/ResponseTest.php

@@ -34,9 +34,9 @@ protected function setUp(): void
  {
  $this->server = $_SERVER;
 
- Services::reset();
-
  parent::setUp();
+
+ $this->resetServices();
  }
 
  protected function tearDown(): void
@@ -164,6 +164,8 @@ public function testSetLink()
  $config->baseURL = 'http://example.com/test/';
  Factories::injectMock('config', 'App', $config);
 
+ $this->resetServices();
+
  $response = new Response($config);
  $pager = Services::pager();
 

tests/system/Helpers/URLHelper/CurrentUrlTest.php

@@ -58,12 +58,38 @@ protected function tearDown(): void
 
  public function testCurrentURLReturnsBasicURL()
  {
- // Since we're on a CLI, we must provide our own URI
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
  $this->config->baseURL = 'http://example.com/public';
 
  $this->assertSame('http://example.com/public/index.php/', current_url());
  }
 
+ public function testCurrentURLReturnsAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://www.example.jp/public/index.php/', current_url());
+ }
+
+ public function testCurrentURLReturnsBaseURLIfNotAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'invalid.example.org';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://example.com/public/index.php/', current_url());
+ }
+
  public function testCurrentURLReturnsObject()
  {
  // Since we're on a CLI, we must provide our own URI

tests/system/Helpers/URLHelper/SiteUrlTest.php

@@ -281,14 +281,49 @@ public function testBaseURLService()
  $_SERVER['HTTP_HOST'] = 'example.com';
  $_SERVER['REQUEST_URI'] = '/ci/v4/x/y';
 
- $uri = new URI('http://example.com/ci/v4/x/y');
- Services::injectMock('uri', $uri);
-
  $this->config->baseURL = 'http://example.com/ci/v4/';
  $request = Services::request($this->config);
  Services::injectMock('request', $request);
 
  $this->assertSame('http://example.com/ci/v4/index.php/controller/method', site_url('controller/method', null, $this->config));
  $this->assertSame('http://example.com/ci/v4/controller/method', base_url('controller/method', null));
  }
+
+ public function testSiteURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/index.php/controller/method',
+ site_url('controller/method', null, $this->config)
+ );
+ }
+
+ public function testBaseURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/controller/method',
+ base_url('controller/method', null)
+ );
+ }
 }

app/Config/App.php

@@ -24,6 +24,20 @@ class App extends BaseConfig
  */
  public string $baseURL = 'http://localhost:8080/';
 
+ /**
+ * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
+ * If you want to accept multiple Hostnames, set this.
+ *
+ * E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
+ * also accepts 'http://media.example.com/' and
+ * 'http://accounts.example.com/':
+ * ['media.example.com', 'accounts.example.com']
+ *
+ * @var string[]
+ * @phpstan-var list<string>
+ */
+ public array $allowedHostnames = [];
+
  /**
  * --------------------------------------------------------------------------
  * Index File

system/HTTP/IncomingRequest.php

@@ -192,14 +192,12 @@ public function detectLocale($config)
  * Sets up our URI object based on the information we have. This is
  * either provided by the user in the baseURL Config setting, or
  * determined from the environment as needed.
+ *
+ * @deprecated $protocol and $baseURL are deprecated. No longer used.
  */
  protected function detectURI(string $protocol, string $baseURL)
  {
- // Passing the config is unnecessary but left for legacy purposes
- $config = clone $this->config;
- $config->baseURL = $baseURL;
-
- $this->setPath($this->detectPath($protocol), $config);
+ $this->setPath($this->detectPath($this->config->uriProtocol), $this->config);
  }
 
  /**
@@ -270,7 +268,7 @@ protected function parseRequestURI(): string
  }
 
  // This section ensures that even on servers that require the URI to contain the query string (Nginx) a correct
- // URI is found, and also fixes the QUERY_STRING getServer var and $_GET array.
+ // URI is found, and also fixes the QUERY_STRING Server var and $_GET array.
  if (trim($uri, '/') === '' && strncmp($query, '/', 1) === 0) {
  $query = explode('?', $query, 2);
  $uri = $query[0];
@@ -400,19 +398,26 @@ public function setPath(string $path, ?App $config = null)
 
  // It's possible the user forgot a trailing slash on their
  // baseURL, so let's help them out.
- $baseURL = $config->baseURL === '' ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
+ $baseURL = ($config->baseURL === '') ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
 
- // Based on our baseURL provided by the developer
- // set our current domain name, scheme
+ // Based on our baseURL and allowedHostnames provided by the developer
+ // and HTTP_HOST, set our current domain name, scheme.
  if ($baseURL !== '') {
+ $host = $this->determineHost($config, $baseURL);
+
+ // Set URI::$baseURL
+ $uri = new URI($baseURL);
+ $currentBaseURL = (string) $uri->setHost($host);
+ $this->uri->setBaseURL($currentBaseURL);
+
  $this->uri->setScheme(parse_url($baseURL, PHP_URL_SCHEME));
- $this->uri->setHost(parse_url($baseURL, PHP_URL_HOST));
+ $this->uri->setHost($host);
  $this->uri->setPort(parse_url($baseURL, PHP_URL_PORT));
 
  // Ensure we have any query vars
  $this->uri->setQuery($_SERVER['QUERY_STRING'] ?? '');
 
- // Check if the baseURL scheme needs to be coerced into its secure version
+ // Check if the scheme needs to be coerced into its secure version
  if ($config->forceGlobalSecureRequests && $this->uri->getScheme() === 'http') {
  $this->uri->setScheme('https');
  }
@@ -425,6 +430,27 @@ public function setPath(string $path, ?App $config = null)
  return $this;
  }
 
+ private function determineHost(App $config, string $baseURL): string
+ {
+ $host = parse_url($baseURL, PHP_URL_HOST);
+
+ if (empty($config->allowedHostnames)) {
+ return $host;
+ }
+
+ // Update host if it is valid.
+ $httpHostPort = $this->getServer('HTTP_HOST');
+ if ($httpHostPort !== null) {
+ [$httpHost] = explode(':', $httpHostPort, 2);
+
+ if (in_array($httpHost, $config->allowedHostnames, true)) {
+ $host = $httpHost;
+ }
+ }
+
+ return $host;
+ }
+
  /**
  * Returns the path relative to SCRIPT_NAME,
  * running detection as necessary.

system/HTTP/URI.php

@@ -11,8 +11,8 @@
 
 namespace CodeIgniter\HTTP;
 
+use BadMethodCallException;
 use CodeIgniter\HTTP\Exceptions\HTTPException;
-use InvalidArgumentException;
 
 /**
  * Abstraction for a uniform resource identifier (URI).
@@ -36,6 +36,11 @@ class URI
  */
  protected $uriString;
 
+ /**
+ * The Current baseURL.
+ */
+ private ?string $baseURL = null;
+
  /**
  * List of URI segments.
  *
@@ -83,6 +88,11 @@ class URI
  /**
  * URI path.
  *
+ * Note: The constructor of the IncomingRequest class changes the path of
+ * the URI object held by the IncomingRequest class to a path relative
+ * to the SCRIPT_NAME. If the baseURL contains subfolders, this value
+ * will be different from the current URI path.
+ *
  * @var string
  */
  protected $path;
@@ -232,9 +242,12 @@ public static function removeDotSegments(string $path): string
  /**
  * Constructor.
  *
- * @param string $uri
+ * @param string|null $uri The URI to parse.
+ *
+ * @throws HTTPException
  *
- * @throws InvalidArgumentException
+ * @TODO null for param $uri should be removed.
+ * See https://www.php-fig.org/psr/psr-17/#26-urifactoryinterface
  */
  public function __construct(?string $uri = null)
  {
@@ -273,6 +286,8 @@ public function useRawQueryString(bool $raw = true)
  * Sets and overwrites any current URI information.
  *
  * @return URI
+ *
+ * @throws HTTPException
  */
  public function setURI(?string $uri = null)
  {
@@ -744,6 +759,30 @@ public function setPath(string $path)
  return $this;
  }
 
+ /**
+ * Sets the current baseURL.
+ *
+ * @interal
+ */
+ public function setBaseURL(string $baseURL): void
+ {
+ $this->baseURL = $baseURL;
+ }
+
+ /**
+ * Returns the current baseURL.
+ *
+ * @interal
+ */
+ public function getBaseURL(): string
+ {
+ if ($this->baseURL === null) {
+ throw new BadMethodCallException('The $baseURL is not set.');
+ }
+
+ return $this->baseURL;
+ }
+
  /**
  * Sets the path portion of the URI based on segments.
  *

system/Helpers/url_helper.php

@@ -9,6 +9,8 @@
  * the LICENSE file that was distributed with this source code.
  */
 
+use CodeIgniter\HTTP\CLIRequest;
+use CodeIgniter\HTTP\Exceptions\HTTPException;
 use CodeIgniter\HTTP\IncomingRequest;
 use CodeIgniter\HTTP\URI;
 use CodeIgniter\Router\Exceptions\RouterException;
@@ -19,14 +21,15 @@
 
 if (! function_exists('_get_uri')) {
  /**
- * Used by the other URL functions to build a
- * framework-specific URI based on the App config.
+ * Used by the other URL functions to build a framework-specific URI
+ * based on $request->getUri()->getBaseURL() and the App config.
  *
- * @internal Outside of the framework this should not be used directly.
+ * @internal Outside the framework this should not be used directly.
  *
  * @param string $relativePath May include queries or fragments
  *
- * @throws InvalidArgumentException For invalid paths or config
+ * @throws HTTPException For invalid paths.
+ * @throws InvalidArgumentException For invalid config.
  */
  function _get_uri(string $relativePath = '', ?App $config = null): URI
  {
@@ -37,7 +40,7 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  }
 
  // If a full URI was passed then convert it
- if (is_int(strpos($relativePath, '://'))) {
+ if (strpos($relativePath, '://') !== false) {
  $full = new URI($relativePath);
  $relativePath = URI::createURIString(
  null,
@@ -51,7 +54,14 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  $relativePath = URI::removeDotSegments($relativePath);
 
  // Build the full URL based on $config and $relativePath
- $url = rtrim($config->baseURL, '/ ') . '/';
+ $request = Services::request();
+
+ if ($request instanceof CLIRequest) {
+ /** @var App $config */
+ $url = rtrim($config->baseURL, '/ ') . '/';
+ } else {
+ $url = $request->getUri()->getBaseURL();
+ }
 
  // Check for an index page
  if ($config->indexPage !== '') {

system/Test/Mock/MockIncomingRequest.php

@@ -15,8 +15,4 @@
 
 class MockIncomingRequest extends IncomingRequest
 {
- protected function detectURI($protocol, $baseURL)
- {
- // Do nothing...
- }
 }

tests/system/HTTP/RedirectResponseTest.php

@@ -40,6 +40,8 @@ protected function setUp(): void
  {
  parent::setUp();
 
+ $this->resetServices();
+
  $_SERVER['REQUEST_METHOD'] = 'GET';
 
  $this->config = new App();
@@ -48,7 +50,12 @@ protected function setUp(): void
  $this->routes = new RouteCollection(Services::locator(), new Modules());
  Services::injectMock('routes', $this->routes);
 
- $this->request = new MockIncomingRequest($this->config, new URI('http://example.com'), null, new UserAgent());
+ $this->request = new MockIncomingRequest(
+ $this->config,
+ new URI('http://example.com'),
+ null,
+ new UserAgent()
+ );
  Services::injectMock('request', $this->request);
  }
 

tests/system/HTTP/ResponseTest.php

@@ -34,9 +34,9 @@ protected function setUp(): void
  {
  $this->server = $_SERVER;
 
- Services::reset();
-
  parent::setUp();
+
+ $this->resetServices();
  }
 
  protected function tearDown(): void
@@ -164,6 +164,8 @@ public function testSetLink()
  $config->baseURL = 'http://example.com/test/';
  Factories::injectMock('config', 'App', $config);
 
+ $this->resetServices();
+
  $response = new Response($config);
  $pager = Services::pager();
 

tests/system/Helpers/URLHelper/CurrentUrlTest.php

@@ -58,12 +58,38 @@ protected function tearDown(): void
 
  public function testCurrentURLReturnsBasicURL()
  {
- // Since we're on a CLI, we must provide our own URI
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
  $this->config->baseURL = 'http://example.com/public';
 
  $this->assertSame('http://example.com/public/index.php/', current_url());
  }
 
+ public function testCurrentURLReturnsAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://www.example.jp/public/index.php/', current_url());
+ }
+
+ public function testCurrentURLReturnsBaseURLIfNotAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'invalid.example.org';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://example.com/public/index.php/', current_url());
+ }
+
  public function testCurrentURLReturnsObject()
  {
  // Since we're on a CLI, we must provide our own URI

tests/system/Helpers/URLHelper/SiteUrlTest.php

@@ -281,14 +281,49 @@ public function testBaseURLService()
  $_SERVER['HTTP_HOST'] = 'example.com';
  $_SERVER['REQUEST_URI'] = '/ci/v4/x/y';
 
- $uri = new URI('http://example.com/ci/v4/x/y');
- Services::injectMock('uri', $uri);
-
  $this->config->baseURL = 'http://example.com/ci/v4/';
  $request = Services::request($this->config);
  Services::injectMock('request', $request);
 
  $this->assertSame('http://example.com/ci/v4/index.php/controller/method', site_url('controller/method', null, $this->config));
  $this->assertSame('http://example.com/ci/v4/controller/method', base_url('controller/method', null));
  }
+
+ public function testSiteURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/index.php/controller/method',
+ site_url('controller/method', null, $this->config)
+ );
+ }
+
+ public function testBaseURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/controller/method',
+ base_url('controller/method', null)
+ );
+ }
 }

app/Config/App.php

@@ -24,6 +24,20 @@ class App extends BaseConfig
  */
  public string $baseURL = 'http://localhost:8080/';
 
+ /**
+ * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
+ * If you want to accept multiple Hostnames, set this.
+ *
+ * E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
+ * also accepts 'http://media.example.com/' and
+ * 'http://accounts.example.com/':
+ * ['media.example.com', 'accounts.example.com']
+ *
+ * @var string[]
+ * @phpstan-var list<string>
+ */
+ public array $allowedHostnames = [];
+
  /**
  * --------------------------------------------------------------------------
  * Index File

system/HTTP/IncomingRequest.php

@@ -192,14 +192,12 @@ public function detectLocale($config)
  * Sets up our URI object based on the information we have. This is
  * either provided by the user in the baseURL Config setting, or
  * determined from the environment as needed.
+ *
+ * @deprecated $protocol and $baseURL are deprecated. No longer used.
  */
  protected function detectURI(string $protocol, string $baseURL)
  {
- // Passing the config is unnecessary but left for legacy purposes
- $config = clone $this->config;
- $config->baseURL = $baseURL;
-
- $this->setPath($this->detectPath($protocol), $config);
+ $this->setPath($this->detectPath($this->config->uriProtocol), $this->config);
  }
 
  /**
@@ -270,7 +268,7 @@ protected function parseRequestURI(): string
  }
 
  // This section ensures that even on servers that require the URI to contain the query string (Nginx) a correct
- // URI is found, and also fixes the QUERY_STRING getServer var and $_GET array.
+ // URI is found, and also fixes the QUERY_STRING Server var and $_GET array.
  if (trim($uri, '/') === '' && strncmp($query, '/', 1) === 0) {
  $query = explode('?', $query, 2);
  $uri = $query[0];
@@ -400,19 +398,26 @@ public function setPath(string $path, ?App $config = null)
 
  // It's possible the user forgot a trailing slash on their
  // baseURL, so let's help them out.
- $baseURL = $config->baseURL === '' ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
+ $baseURL = ($config->baseURL === '') ? $config->baseURL : rtrim($config->baseURL, '/ ') . '/';
 
- // Based on our baseURL provided by the developer
- // set our current domain name, scheme
+ // Based on our baseURL and allowedHostnames provided by the developer
+ // and HTTP_HOST, set our current domain name, scheme.
  if ($baseURL !== '') {
+ $host = $this->determineHost($config, $baseURL);
+
+ // Set URI::$baseURL
+ $uri = new URI($baseURL);
+ $currentBaseURL = (string) $uri->setHost($host);
+ $this->uri->setBaseURL($currentBaseURL);
+
  $this->uri->setScheme(parse_url($baseURL, PHP_URL_SCHEME));
- $this->uri->setHost(parse_url($baseURL, PHP_URL_HOST));
+ $this->uri->setHost($host);
  $this->uri->setPort(parse_url($baseURL, PHP_URL_PORT));
 
  // Ensure we have any query vars
  $this->uri->setQuery($_SERVER['QUERY_STRING'] ?? '');
 
- // Check if the baseURL scheme needs to be coerced into its secure version
+ // Check if the scheme needs to be coerced into its secure version
  if ($config->forceGlobalSecureRequests && $this->uri->getScheme() === 'http') {
  $this->uri->setScheme('https');
  }
@@ -425,6 +430,27 @@ public function setPath(string $path, ?App $config = null)
  return $this;
  }
 
+ private function determineHost(App $config, string $baseURL): string
+ {
+ $host = parse_url($baseURL, PHP_URL_HOST);
+
+ if (empty($config->allowedHostnames)) {
+ return $host;
+ }
+
+ // Update host if it is valid.
+ $httpHostPort = $this->getServer('HTTP_HOST');
+ if ($httpHostPort !== null) {
+ [$httpHost] = explode(':', $httpHostPort, 2);
+
+ if (in_array($httpHost, $config->allowedHostnames, true)) {
+ $host = $httpHost;
+ }
+ }
+
+ return $host;
+ }
+
  /**
  * Returns the path relative to SCRIPT_NAME,
  * running detection as necessary.

system/HTTP/URI.php

@@ -11,8 +11,8 @@
 
 namespace CodeIgniter\HTTP;
 
+use BadMethodCallException;
 use CodeIgniter\HTTP\Exceptions\HTTPException;
-use InvalidArgumentException;
 
 /**
  * Abstraction for a uniform resource identifier (URI).
@@ -36,6 +36,11 @@ class URI
  */
  protected $uriString;
 
+ /**
+ * The Current baseURL.
+ */
+ private ?string $baseURL = null;
+
  /**
  * List of URI segments.
  *
@@ -83,6 +88,11 @@ class URI
  /**
  * URI path.
  *
+ * Note: The constructor of the IncomingRequest class changes the path of
+ * the URI object held by the IncomingRequest class to a path relative
+ * to the SCRIPT_NAME. If the baseURL contains subfolders, this value
+ * will be different from the current URI path.
+ *
  * @var string
  */
  protected $path;
@@ -232,9 +242,12 @@ public static function removeDotSegments(string $path): string
  /**
  * Constructor.
  *
- * @param string $uri
+ * @param string|null $uri The URI to parse.
+ *
+ * @throws HTTPException
  *
- * @throws InvalidArgumentException
+ * @TODO null for param $uri should be removed.
+ * See https://www.php-fig.org/psr/psr-17/#26-urifactoryinterface
  */
  public function __construct(?string $uri = null)
  {
@@ -273,6 +286,8 @@ public function useRawQueryString(bool $raw = true)
  * Sets and overwrites any current URI information.
  *
  * @return URI
+ *
+ * @throws HTTPException
  */
  public function setURI(?string $uri = null)
  {
@@ -744,6 +759,30 @@ public function setPath(string $path)
  return $this;
  }
 
+ /**
+ * Sets the current baseURL.
+ *
+ * @interal
+ */
+ public function setBaseURL(string $baseURL): void
+ {
+ $this->baseURL = $baseURL;
+ }
+
+ /**
+ * Returns the current baseURL.
+ *
+ * @interal
+ */
+ public function getBaseURL(): string
+ {
+ if ($this->baseURL === null) {
+ throw new BadMethodCallException('The $baseURL is not set.');
+ }
+
+ return $this->baseURL;
+ }
+
  /**
  * Sets the path portion of the URI based on segments.
  *

system/Helpers/url_helper.php

@@ -9,6 +9,8 @@
  * the LICENSE file that was distributed with this source code.
  */
 
+use CodeIgniter\HTTP\CLIRequest;
+use CodeIgniter\HTTP\Exceptions\HTTPException;
 use CodeIgniter\HTTP\IncomingRequest;
 use CodeIgniter\HTTP\URI;
 use CodeIgniter\Router\Exceptions\RouterException;
@@ -19,14 +21,15 @@
 
 if (! function_exists('_get_uri')) {
  /**
- * Used by the other URL functions to build a
- * framework-specific URI based on the App config.
+ * Used by the other URL functions to build a framework-specific URI
+ * based on $request->getUri()->getBaseURL() and the App config.
  *
- * @internal Outside of the framework this should not be used directly.
+ * @internal Outside the framework this should not be used directly.
  *
  * @param string $relativePath May include queries or fragments
  *
- * @throws InvalidArgumentException For invalid paths or config
+ * @throws HTTPException For invalid paths.
+ * @throws InvalidArgumentException For invalid config.
  */
  function _get_uri(string $relativePath = '', ?App $config = null): URI
  {
@@ -37,7 +40,7 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  }
 
  // If a full URI was passed then convert it
- if (is_int(strpos($relativePath, '://'))) {
+ if (strpos($relativePath, '://') !== false) {
  $full = new URI($relativePath);
  $relativePath = URI::createURIString(
  null,
@@ -51,7 +54,14 @@ function _get_uri(string $relativePath = '', ?App $config = null): URI
  $relativePath = URI::removeDotSegments($relativePath);
 
  // Build the full URL based on $config and $relativePath
- $url = rtrim($config->baseURL, '/ ') . '/';
+ $request = Services::request();
+
+ if ($request instanceof CLIRequest) {
+ /** @var App $config */
+ $url = rtrim($config->baseURL, '/ ') . '/';
+ } else {
+ $url = $request->getUri()->getBaseURL();
+ }
 
  // Check for an index page
  if ($config->indexPage !== '') {

system/Test/Mock/MockIncomingRequest.php

@@ -15,8 +15,4 @@
 
 class MockIncomingRequest extends IncomingRequest
 {
- protected function detectURI($protocol, $baseURL)
- {
- // Do nothing...
- }
 }

tests/system/HTTP/RedirectResponseTest.php

@@ -40,6 +40,8 @@ protected function setUp(): void
  {
  parent::setUp();
 
+ $this->resetServices();
+
  $_SERVER['REQUEST_METHOD'] = 'GET';
 
  $this->config = new App();
@@ -48,7 +50,12 @@ protected function setUp(): void
  $this->routes = new RouteCollection(Services::locator(), new Modules());
  Services::injectMock('routes', $this->routes);
 
- $this->request = new MockIncomingRequest($this->config, new URI('http://example.com'), null, new UserAgent());
+ $this->request = new MockIncomingRequest(
+ $this->config,
+ new URI('http://example.com'),
+ null,
+ new UserAgent()
+ );
  Services::injectMock('request', $this->request);
  }
 

tests/system/HTTP/ResponseTest.php

@@ -34,9 +34,9 @@ protected function setUp(): void
  {
  $this->server = $_SERVER;
 
- Services::reset();
-
  parent::setUp();
+
+ $this->resetServices();
  }
 
  protected function tearDown(): void
@@ -164,6 +164,8 @@ public function testSetLink()
  $config->baseURL = 'http://example.com/test/';
  Factories::injectMock('config', 'App', $config);
 
+ $this->resetServices();
+
  $response = new Response($config);
  $pager = Services::pager();
 

tests/system/Helpers/URLHelper/CurrentUrlTest.php

@@ -58,12 +58,38 @@ protected function tearDown(): void
 
  public function testCurrentURLReturnsBasicURL()
  {
- // Since we're on a CLI, we must provide our own URI
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
  $this->config->baseURL = 'http://example.com/public';
 
  $this->assertSame('http://example.com/public/index.php/', current_url());
  }
 
+ public function testCurrentURLReturnsAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://www.example.jp/public/index.php/', current_url());
+ }
+
+ public function testCurrentURLReturnsBaseURLIfNotAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'invalid.example.org';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ $this->assertSame('http://example.com/public/index.php/', current_url());
+ }
+
  public function testCurrentURLReturnsObject()
  {
  // Since we're on a CLI, we must provide our own URI

tests/system/Helpers/URLHelper/SiteUrlTest.php

@@ -281,14 +281,49 @@ public function testBaseURLService()
  $_SERVER['HTTP_HOST'] = 'example.com';
  $_SERVER['REQUEST_URI'] = '/ci/v4/x/y';
 
- $uri = new URI('http://example.com/ci/v4/x/y');
- Services::injectMock('uri', $uri);
-
  $this->config->baseURL = 'http://example.com/ci/v4/';
  $request = Services::request($this->config);
  Services::injectMock('request', $request);
 
  $this->assertSame('http://example.com/ci/v4/index.php/controller/method', site_url('controller/method', null, $this->config));
  $this->assertSame('http://example.com/ci/v4/controller/method', base_url('controller/method', null));
  }
+
+ public function testSiteURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/index.php/controller/method',
+ site_url('controller/method', null, $this->config)
+ );
+ }
+
+ public function testBaseURLWithAllowedHostname()
+ {
+ $_SERVER['HTTP_HOST'] = 'www.example.jp';
+ $_SERVER['REQUEST_URI'] = '/public';
+ $_SERVER['SCRIPT_NAME'] = '/public/index.php';
+
+ $this->config->baseURL = 'http://example.com/public/';
+ $this->config->allowedHostnames = ['www.example.jp'];
+
+ // URI object are updated in IncomingRequest constructor.
+ $request = Services::incomingrequest($this->config);
+ Services::injectMock('request', $request);
+
+ $this->assertSame(
+ 'http://www.example.jp/public/controller/method',
+ base_url('controller/method', null)
+ );
+ }
 }