I have a penetration test finding that needs to block request from client if its 'Origin' Header didn't meet the criteria, for example it must be '192.168.2.123:8888'.
If the Header was 'Host', I have successfully handle it by configure these in <VirtualHost>
:
RewriteEngine On
RewriteCond %{HTTP_HOST} !^([a-zA-Z0-9-_]{1,20}.){0,3}192.168.2.123:8888$
RewriteRule ^(.*)$ http://192.168.2.123:8888/app/ui [R=404,L]
But for 'Origin' Header, I can't get HTTP_ORIGIN (I'm not sure whether that predefined variable exist). I have configured these but not working:
<If "req('Origin') != '192.168.2.123:8888'">
ErrorDocument 404 default
</If>
How can I find the configuration to read 'Origin' and send response 404 for it? thank you.