Remove rewrite header

Improve request ids

Dockerfile

@@ -21,3 +21,4 @@ ENV password=password
 ENV exposeConfigPath=/src/config/expose.php
 
 CMD sed -i "s|username|${username}|g" ${exposeConfigPath} && sed -i "s|password|${password}|g" ${exposeConfigPath} && php expose serve ${domain} --port ${port} --validateAuthTokens
+ENTRYPOINT ["/src/expose"]

app/Client/Client.php

@@ -45,13 +45,13 @@ class Client
         $sharedUrl = $this->prepareSharedUrl($sharedUrl);
 
         foreach ($subdomains as $subdomain) {
-            $this->connectToServer($sharedUrl, $subdomain, config('expose.auth_token'));
+            $this->connectToServer($sharedUrl, $subdomain, $this->configuration->auth());
         }
     }
 
     public function sharePort(int $port)
     {
-        $this->connectToServerAndShareTcp($port, config('expose.auth_token'));
+        $this->connectToServerAndShareTcp($port, $this->configuration->auth());
     }
 
     protected function prepareSharedUrl(string $sharedUrl): string
@@ -60,16 +60,11 @@ class Client
             return $sharedUrl;
         }
 
-        $url = Arr::get($parsedUrl, 'host', Arr::get($parsedUrl, 'path'));
+        $host = Arr::get($parsedUrl, 'host', Arr::get($parsedUrl, 'path', 'localhost'));
+        $scheme = Arr::get($parsedUrl, 'scheme', 'http');
+        $port = Arr::get($parsedUrl, 'port', $scheme === 'https' ? 443 : 80);
 
-        if (Arr::get($parsedUrl, 'scheme') === 'https') {
-            $url .= ':443';
-        }
-        if (! is_null($port = Arr::get($parsedUrl, 'port'))) {
-            $url .= ":{$port}";
-        }
-
-        return $url;
+        return sprintf('%s://%s:%s', $scheme, $host, $port);
     }
 
     public function connectToServer(string $sharedUrl, $subdomain, $authToken = ''): PromiseInterface
@@ -197,6 +192,14 @@ class Client
 
     protected function attachCommonConnectionListeners(ControlConnection $connection, Deferred $deferred)
     {
+        $connection->on('info', function ($data) {
+            $this->logger->info($data->message);
+        });
+
+        $connection->on('error', function ($data) {
+            $this->logger->error($data->message);
+        });
+
         $connection->on('authenticationFailed', function ($data) use ($deferred) {
             $this->logger->error($data->message);
 

app/Client/Configuration.php

@@ -36,4 +36,16 @@ class Configuration
     {
         return intval($this->port);
     }
+
+    public function getUrl(string $subdomain): string
+    {
+        $httpProtocol = $this->port() === 443 ? 'https' : 'http';
+        $host = $this->host();
+
+        if ($httpProtocol !== 'https') {
+            $host .= ":{$this->port()}";
+        }
+
+        return "{$subdomain}.{$host}";
+    }
 }

app/Client/Http/HttpClient.php

@@ -2,6 +2,7 @@
 
 namespace App\Client\Http;
 
+use App\Client\Configuration;
 use App\Client\Http\Modifiers\CheckBasicAuthentication;
 use App\Logger\RequestLogger;
 use Clue\React\Buzz\Browser;
@@ -10,10 +11,12 @@ use function GuzzleHttp\Psr7\str;
 use Laminas\Http\Request;
 use Psr\Http\Message\RequestInterface;
 use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\UriInterface;
 use Ratchet\Client\WebSocket;
 use Ratchet\RFC6455\Messaging\Frame;
 use React\EventLoop\LoopInterface;
 use React\Socket\Connector;
+use React\Stream\ReadableStreamInterface;
 
 class HttpClient
 {
@@ -26,19 +29,26 @@ class HttpClient
     /** @var Request */
     protected $request;
 
+    protected $connectionData;
+
     /** @var array */
     protected $modifiers = [
         CheckBasicAuthentication::class,
     ];
+    /** @var Configuration */
+    protected $configuration;
 
-    public function __construct(LoopInterface $loop, RequestLogger $logger)
+    public function __construct(LoopInterface $loop, RequestLogger $logger, Configuration $configuration)
     {
         $this->loop = $loop;
         $this->logger = $logger;
+        $this->configuration = $configuration;
     }
 
-    public function performRequest(string $requestData, WebSocket $proxyConnection = null, string $requestId = null)
+    public function performRequest(string $requestData, WebSocket $proxyConnection = null, $connectionData = null)
     {
+        $this->connectionData = $connectionData;
+
         $this->request = $this->parseRequest($requestData);
 
         $this->logger->logRequest($requestData, $this->request);
@@ -66,7 +76,6 @@ class HttpClient
     protected function createConnector(): Connector
     {
         return new Connector($this->loop, [
-            'dns' => '127.0.0.1',
             'tls' => [
                 'verify_peer' => false,
                 'verify_peer_name' => false,
@@ -77,12 +86,9 @@ class HttpClient
     protected function sendRequestToApplication(RequestInterface $request, $proxyConnection = null)
     {
         (new Browser($this->loop, $this->createConnector()))
-            ->withOptions([
-                'followRedirects' => false,
-                'obeySuccessCode' => false,
-                'streaming' => true,
-            ])
-            ->send($request)
+            ->withFollowRedirects(false)
+            ->withRejectErrorResponse(false)
+            ->requestStreaming($request->getMethod(), $this->getExposeUri($request), $request->getHeaders(), $request->getBody())
             ->then(function (ResponseInterface $response) use ($proxyConnection) {
                 if (! isset($response->buffer)) {
                     $response->buffer = str($response);
@@ -90,7 +96,7 @@ class HttpClient
 
                 $this->sendChunkToServer($response->buffer, $proxyConnection);
 
-                /* @var $body \React\Stream\ReadableStreamInterface */
+                /* @var $body ReadableStreamInterface */
                 $body = $response->getBody();
 
                 $this->logResponse(str($response));
@@ -126,4 +132,15 @@ class HttpClient
     {
         return Request::fromString($data);
     }
+
+    private function getExposeUri(RequestInterface $request): UriInterface
+    {
+        $exposeProto = $request->getHeader('x-expose-proto')[0];
+        $exposeHost = explode(':', $request->getHeader('x-expose-host')[0]);
+
+        return $request->getUri()
+            ->withScheme($exposeProto)
+            ->withHost($exposeHost[0])
+            ->withPort($exposeHost[1]);
+    }
 }

app/Client/ProxyManager.php

@@ -32,7 +32,7 @@ class ProxyManager
         ], $this->loop)
             ->then(function (WebSocket $proxyConnection) use ($clientId, $connectionData) {
                 $proxyConnection->on('message', function ($message) use ($proxyConnection, $connectionData) {
-                    $this->performRequest($proxyConnection, $connectionData->request_id, (string) $message);
+                    $this->performRequest($proxyConnection, (string) $message, $connectionData);
                 });
 
                 $proxyConnection->send(json_encode([
@@ -76,8 +76,8 @@ class ProxyManager
             });
     }
 
-    protected function performRequest(WebSocket $proxyConnection, $requestId, string $requestData)
+    protected function performRequest(WebSocket $proxyConnection, string $requestData, $connectionData)
     {
-        app(HttpClient::class)->performRequest((string) $requestData, $proxyConnection, $requestId);
+        app(HttpClient::class)->performRequest((string) $requestData, $proxyConnection, $connectionData);
     }
 }

app/Commands/ShareCommand.php

@@ -10,7 +10,7 @@ use Symfony\Component\Console\Output\ConsoleOutput;
 
 class ShareCommand extends Command
 {
-    protected $signature = 'share {host} {--subdomain=} {--auth=}';
+    protected $signature = 'share {host} {--subdomain=} {--auth=} {--server-host=} {--server-port=}';
 
     protected $description = 'Share a local url with a remote expose server';
 
@@ -27,11 +27,15 @@ class ShareCommand extends Command
     {
         $this->configureConnectionLogger();
 
+        $serverHost = $this->option('server-host') ?? config('expose.host', 'localhost');
+        $serverPort = $this->option('server-port') ?? config('expose.port', 8080);
+        $auth = $this->option('auth') ?? config('expose.auth_token', '');
+
         (new Factory())
             ->setLoop(app(LoopInterface::class))
-            ->setHost(config('expose.host', 'localhost'))
-            ->setPort(config('expose.port', 8080))
-            ->setAuth($this->option('auth'))
+            ->setHost($serverHost)
+            ->setPort($serverPort)
+            ->setAuth($auth)
             ->createClient()
             ->share($this->argument('host'), explode(',', $this->option('subdomain')))
             ->createHttpServer()

app/Commands/ShareCurrentWorkingDirectoryCommand.php

@@ -4,7 +4,7 @@ namespace App\Commands;
 
 class ShareCurrentWorkingDirectoryCommand extends ShareCommand
 {
-    protected $signature = 'share-cwd {host?} {--subdomain=} {--auth=}';
+    protected $signature = 'share-cwd {host?} {--subdomain=} {--auth=} {--server-host=} {--server-port=}';
 
     public function handle()
     {

app/Contracts/SubdomainRepository.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Contracts;
+
+use React\Promise\PromiseInterface;
+
+interface SubdomainRepository
+{
+    public function getSubdomains(): PromiseInterface;
+
+    public function getSubdomainById($id): PromiseInterface;
+
+    public function getSubdomainByName(string $name): PromiseInterface;
+
+    public function getSubdomainsByUserId($id): PromiseInterface;
+
+    public function getSubdomainsByUserIdAndName($id, $name): PromiseInterface;
+
+    public function deleteSubdomainForUserId($userId, $subdomainId): PromiseInterface;
+
+    public function storeSubdomain(array $data): PromiseInterface;
+}

app/Logger/LoggedRequest.php

@@ -19,11 +19,8 @@ class LoggedRequest implements \JsonSerializable
     /** @var Request */
     protected $parsedRequest;
 
-    /** @var string */
-    protected $rawResponse;
-
-    /** @var Response */
-    protected $parsedResponse;
+    /** @var LoggedResponse */
+    protected $response;
 
     /** @var string */
     protected $id;
@@ -71,22 +68,8 @@ class LoggedRequest implements \JsonSerializable
             ],
         ];
 
-        if ($this->parsedResponse) {
-            $logBody = $this->shouldReturnBody();
-
-            try {
-                $body = $logBody ? $this->parsedResponse->getBody() : '';
-            } catch (\Exception $e) {
-                $body = '';
-            }
-
-            $data['response'] = [
-                'raw' => $logBody ? $this->rawResponse : 'SKIPPED BY CONFIG OR BINARY RESPONSE',
-                'status' => $this->parsedResponse->getStatusCode(),
-                'headers' => $this->parsedResponse->getHeaders()->toArray(),
-                'reason' => $this->parsedResponse->getReasonPhrase(),
-                'body' => $logBody ? $body : 'SKIPPED BY CONFIG OR BINARY RESPONSE',
-            ];
+        if ($this->response) {
+            $data['response'] = $this->response->toArray();
         }
 
         return $data;
@@ -107,96 +90,6 @@ class LoggedRequest implements \JsonSerializable
         return preg_match('~[^\x20-\x7E\t\r\n]~', $string) > 0;
     }
 
-    protected function shouldReturnBody(): bool
-    {
-        if ($this->skipByStatus()) {
-            return false;
-        }
-
-        if ($this->skipByContentType()) {
-            return false;
-        }
-
-        if ($this->skipByExtension()) {
-            return false;
-        }
-
-        if ($this->skipBySize()) {
-            return false;
-        }
-
-        $header = $this->parsedResponse->getHeaders()->get('Content-Type');
-        $contentType = $header ? $header->getMediaType() : '';
-        $patterns = [
-            'application/json',
-            'text/*',
-            '*javascript*',
-        ];
-
-        return Str::is($patterns, $contentType);
-    }
-
-    protected function skipByStatus(): bool
-    {
-        if (empty(config()->get('expose.skip_body_log.status'))) {
-            return false;
-        }
-
-        return Str::is(config()->get('expose.skip_body_log.status'), $this->parsedResponse->getStatusCode());
-    }
-
-    protected function skipByContentType(): bool
-    {
-        if (empty(config()->get('expose.skip_body_log.content_type'))) {
-            return false;
-        }
-
-        $header = $this->parsedResponse->getHeaders()->get('Content-Type');
-        $contentType = $header ? $header->getMediaType() : '';
-
-        return Str::is(config()->get('expose.skip_body_log.content_type'), $contentType);
-    }
-
-    protected function skipByExtension(): bool
-    {
-        if (empty(config()->get('expose.skip_body_log.extension'))) {
-            return false;
-        }
-
-        return Str::is(config()->get('expose.skip_body_log.extension'), $this->parsedRequest->getUri()->getPath());
-    }
-
-    protected function skipBySize(): bool
-    {
-        $configSize = $this->getConfigSize(config()->get('expose.skip_body_log.size', '1MB'));
-        $contentLength = $this->parsedResponse->getHeaders()->get('Content-Length');
-
-        if (! $contentLength) {
-            return false;
-        }
-
-        $contentSize = $contentLength->getFieldValue() ?? 0;
-
-        return $contentSize > $configSize;
-    }
-
-    protected function getConfigSize(string $size): int
-    {
-        $units = ['B', 'KB', 'MB', 'GB'];
-        $number = substr($size, 0, -2);
-        $suffix = strtoupper(substr($size, -2));
-
-        // B or no suffix
-        if (is_numeric(substr($suffix, 0, 1))) {
-            return preg_replace('/[^\d]/', '', $size);
-        }
-
-        // if we have an error in the input, default to GB
-        $exponent = array_flip($units)[$suffix] ?? 5;
-
-        return $number * (1024 ** $exponent);
-    }
-
     public function getRequest()
     {
         return $this->parsedRequest;
@@ -204,9 +97,7 @@ class LoggedRequest implements \JsonSerializable
 
     public function setResponse(string $rawResponse, Response $response)
     {
-        $this->parsedResponse = $response;
-
-        $this->rawResponse = $rawResponse;
+        $this->response = new LoggedResponse($rawResponse, $response, $this->getRequest());
 
         if (is_null($this->stopTime)) {
             $this->stopTime = now();
@@ -223,9 +114,9 @@ class LoggedRequest implements \JsonSerializable
         return $this->rawRequest;
     }
 
-    public function getResponse(): ?Response
+    public function getResponse(): ?LoggedResponse
     {
-        return $this->parsedResponse;
+        return $this->response;
     }
 
     public function getPostData()

app/Logger/LoggedResponse.php

@@ -0,0 +1,160 @@
+<?php
+
+namespace App\Logger;
+
+use Illuminate\Support\Str;
+use Laminas\Http\Request;
+use Laminas\Http\Response;
+
+class LoggedResponse
+{
+    /** @var string */
+    protected $rawResponse;
+
+    /** @var Response */
+    protected $response;
+
+    /** @var Request */
+    protected $request;
+
+    protected $reasonPhrase;
+    protected $body;
+    protected $statusCode;
+    protected $headers;
+
+    public function __construct(string $rawResponse, Response $response, Request $request)
+    {
+        $this->rawResponse = $rawResponse;
+        $this->response = $response;
+        $this->request = $request;
+
+        if (! $this->shouldReturnBody()) {
+            $this->rawResponse = 'SKIPPED BY CONFIG OR BINARY RESPONSE';
+            $this->body = 'SKIPPED BY CONFIG OR BINARY RESPONSE';
+        } else {
+            try {
+                $this->body = $response->getBody();
+            } catch (\Exception $e) {
+                $this->body = '';
+            }
+        }
+
+        $this->statusCode = $response->getStatusCode();
+        $this->reasonPhrase = $response->getReasonPhrase();
+        $this->headers = $response->getHeaders()->toArray();
+
+        $this->response = null;
+        $this->request = null;
+    }
+
+    protected function shouldReturnBody(): bool
+    {
+        if ($this->skipByStatus()) {
+            return false;
+        }
+
+        if ($this->skipByContentType()) {
+            return false;
+        }
+
+        if ($this->skipByExtension()) {
+            return false;
+        }
+
+        if ($this->skipBySize()) {
+            return false;
+        }
+
+        $header = $this->response->getHeaders()->get('Content-Type');
+        $contentType = $header ? $header->getMediaType() : '';
+        $patterns = [
+            'application/json',
+            'text/*',
+            '*javascript*',
+        ];
+
+        return Str::is($patterns, $contentType);
+    }
+
+    protected function skipByStatus(): bool
+    {
+        if (empty(config()->get('expose.skip_body_log.status'))) {
+            return false;
+        }
+
+        return Str::is(config()->get('expose.skip_body_log.status'), $this->response->getStatusCode());
+    }
+
+    protected function skipByContentType(): bool
+    {
+        if (empty(config()->get('expose.skip_body_log.content_type'))) {
+            return false;
+        }
+
+        $header = $this->response->getHeaders()->get('Content-Type');
+        $contentType = $header ? $header->getMediaType() : '';
+
+        return Str::is(config()->get('expose.skip_body_log.content_type'), $contentType);
+    }
+
+    protected function skipByExtension(): bool
+    {
+        if (empty(config()->get('expose.skip_body_log.extension'))) {
+            return false;
+        }
+
+        return Str::is(config()->get('expose.skip_body_log.extension'), $this->request->getUri()->getPath());
+    }
+
+    protected function skipBySize(): bool
+    {
+        $configSize = $this->getConfigSize(config()->get('expose.skip_body_log.size', '1MB'));
+        $contentLength = $this->response->getHeaders()->get('Content-Length');
+
+        if (! $contentLength) {
+            return false;
+        }
+
+        $contentSize = $contentLength->getFieldValue() ?? 0;
+
+        return $contentSize > $configSize;
+    }
+
+    protected function getConfigSize(string $size): int
+    {
+        $units = ['B', 'KB', 'MB', 'GB'];
+        $number = substr($size, 0, -2);
+        $suffix = strtoupper(substr($size, -2));
+
+        // B or no suffix
+        if (is_numeric(substr($suffix, 0, 1))) {
+            return preg_replace('/[^\d]/', '', $size);
+        }
+
+        // if we have an error in the input, default to GB
+        $exponent = array_flip($units)[$suffix] ?? 5;
+
+        return $number * (1024 ** $exponent);
+    }
+
+    public function getStatusCode()
+    {
+        return $this->statusCode;
+    }
+
+    public function getReasonPhrase()
+    {
+        return $this->reasonPhrase;
+    }
+
+    public function toArray()
+    {
+        return [
+            'raw' => $this->rawResponse,
+            'status' => $this->statusCode,
+            'headers' => $this->headers,
+            'reason' => $this->reasonPhrase,
+            'body' => $this->body,
+        ];
+    }
+}

app/Providers/AppServiceProvider.php

@@ -37,6 +37,14 @@ class AppServiceProvider extends ServiceProvider
     {
         $builtInConfig = config('expose');
 
+        $keyServerVariable = 'EXPOSE_CONFIG_FILE';
+        if (array_key_exists($keyServerVariable, $_SERVER) && is_string($_SERVER[$keyServerVariable]) && file_exists($_SERVER[$keyServerVariable])) {
+            $localConfig = require $_SERVER[$keyServerVariable];
+            config()->set('expose', array_merge($builtInConfig, $localConfig));
+
+            return;
+        }
+
         $localConfigFile = getcwd().DIRECTORY_SEPARATOR.'.expose.php';
 
         if (file_exists($localConfigFile)) {

app/Server/Connections/ConnectionManager.php

@@ -45,15 +45,13 @@ class ConnectionManager implements ConnectionManagerContract
 
     public function storeConnection(string $host, ?string $subdomain, ConnectionInterface $connection): ControlConnection
     {
-        $clientId = (string) uniqid();
-
-        $connection->client_id = $clientId;
+        $connection->client_id = sha1(uniqid('', true));
 
         $storedConnection = new ControlConnection(
             $connection,
             $host,
             $subdomain ?? $this->subdomainGenerator->generateSubdomain(),
-            $clientId,
+            $connection->client_id,
             $this->getAuthTokenFromConnection($connection)
         );
 

app/Server/Connections/ControlConnection.php

@@ -43,6 +43,8 @@ class ControlConnection
         $this->socket->send(json_encode([
             'event' => 'createProxy',
             'data' => [
+                'host' => $this->host,
+                'subdomain' => $this->subdomain,
                 'request_id' => $requestId,
                 'client_id' => $this->client_id,
             ],

app/Server/Factory.php

@@ -4,10 +4,12 @@ namespace App\Server;
 
 use App\Contracts\ConnectionManager as ConnectionManagerContract;
 use App\Contracts\SubdomainGenerator;
+use App\Contracts\SubdomainRepository;
 use App\Contracts\UserRepository;
 use App\Http\RouteGenerator;
 use App\Http\Server as HttpServer;
 use App\Server\Connections\ConnectionManager;
+use App\Server\Http\Controllers\Admin\DeleteSubdomainController;
 use App\Server\Http\Controllers\Admin\DeleteUsersController;
 use App\Server\Http\Controllers\Admin\DisconnectSiteController;
 use App\Server\Http\Controllers\Admin\DisconnectTcpConnectionController;
@@ -22,6 +24,7 @@ use App\Server\Http\Controllers\Admin\ListUsersController;
 use App\Server\Http\Controllers\Admin\RedirectToUsersController;
 use App\Server\Http\Controllers\Admin\ShowSettingsController;
 use App\Server\Http\Controllers\Admin\StoreSettingsController;
+use App\Server\Http\Controllers\Admin\StoreSubdomainController;
 use App\Server\Http\Controllers\Admin\StoreUsersController;
 use App\Server\Http\Controllers\ControlMessageController;
 use App\Server\Http\Controllers\TunnelMessageController;
@@ -130,6 +133,8 @@ class Factory
         $this->router->get('/api/users', GetUsersController::class, $adminCondition);
         $this->router->post('/api/users', StoreUsersController::class, $adminCondition);
         $this->router->get('/api/users/{id}', GetUserDetailsController::class, $adminCondition);
+        $this->router->post('/api/subdomains', StoreSubdomainController::class, $adminCondition);
+        $this->router->delete('/api/subdomains/{subdomain}', DeleteSubdomainController::class, $adminCondition);
         $this->router->delete('/api/users/{id}', DeleteUsersController::class, $adminCondition);
         $this->router->get('/api/sites', GetSitesController::class, $adminCondition);
         $this->router->delete('/api/sites/{id}', DisconnectSiteController::class, $adminCondition);
@@ -171,6 +176,7 @@ class Factory
         $this->bindConfiguration()
             ->bindSubdomainGenerator()
             ->bindUserRepository()
+            ->bindSubdomainRepository()
             ->bindDatabase()
             ->ensureDatabaseIsInitialized()
             ->bindConnectionManager()
@@ -207,6 +213,15 @@ class Factory
         return $this;
     }
 
+    protected function bindSubdomainRepository()
+    {
+        app()->singleton(SubdomainRepository::class, function () {
+            return app(config('expose.admin.subdomain_repository'));
+        });
+
+        return $this;
+    }
+
     protected function bindDatabase()
     {
         app()->singleton(DatabaseInterface::class, function () {

app/Server/Http/Controllers/Admin/DeleteSubdomainController.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Server\Http\Controllers\Admin;
+
+use App\Contracts\SubdomainRepository;
+use App\Contracts\UserRepository;
+use Illuminate\Http\Request;
+use Ratchet\ConnectionInterface;
+
+class DeleteSubdomainController extends AdminController
+{
+    protected $keepConnectionOpen = true;
+
+    /** @var SubdomainRepository */
+    protected $subdomainRepository;
+
+    /** @var UserRepository */
+    protected $userRepository;
+
+    public function __construct(UserRepository $userRepository, SubdomainRepository $subdomainRepository)
+    {
+        $this->userRepository = $userRepository;
+        $this->subdomainRepository = $subdomainRepository;
+    }
+
+    public function handle(Request $request, ConnectionInterface $httpConnection)
+    {
+        $this->userRepository->getUserByToken($request->get('auth_token', ''))
+            ->then(function ($user) use ($request, $httpConnection) {
+                if (is_null($user)) {
+                    $httpConnection->send(respond_json(['error' => 'The user does not exist'], 404));
+                    $httpConnection->close();
+
+                    return;
+                }
+
+                $this->subdomainRepository->deleteSubdomainForUserId($user['id'], $request->get('subdomain'))
+                    ->then(function ($deleted) use ($httpConnection) {
+                        $httpConnection->send(respond_json(['deleted' => $deleted], 200));
+                        $httpConnection->close();
+                    });
+            });
+    }
+}

app/Server/Http/Controllers/Admin/GetUserDetailsController.php

@@ -2,6 +2,7 @@
 
 namespace App\Server\Http\Controllers\Admin;
 
+use App\Contracts\SubdomainRepository;
 use App\Contracts\UserRepository;
 use Illuminate\Http\Request;
 use Ratchet\ConnectionInterface;
@@ -13,21 +14,31 @@ class GetUserDetailsController extends AdminController
     /** @var UserRepository */
     protected $userRepository;
 
-    public function __construct(UserRepository $userRepository)
+    /** @var SubdomainRepository */
+    protected $subdomainRepository;
+
+    public function __construct(UserRepository $userRepository, SubdomainRepository $subdomainRepository)
     {
         $this->userRepository = $userRepository;
+        $this->subdomainRepository = $subdomainRepository;
     }
 
     public function handle(Request $request, ConnectionInterface $httpConnection)
     {
         $this->userRepository
             ->getUserById($request->get('id'))
-            ->then(function ($user) use ($httpConnection) {
+            ->then(function ($user) use ($httpConnection, $request) {
+                $this->subdomainRepository->getSubdomainsByUserId($request->get('id'))
+                    ->then(function ($subdomains) use ($httpConnection, $user) {
                         $httpConnection->send(
-                    respond_json(['user' => $user])
+                            respond_json([
+                                'user' => $user,
+                                'subdomains' => $subdomains,
+                            ])
                         );
 
                         $httpConnection->close();
                     });
+            });
     }
 }

app/Server/Http/Controllers/Admin/StoreSubdomainController.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Server\Http\Controllers\Admin;
+
+use App\Contracts\SubdomainRepository;
+use App\Contracts\UserRepository;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
+use Ratchet\ConnectionInterface;
+
+class StoreSubdomainController extends AdminController
+{
+    protected $keepConnectionOpen = true;
+
+    /** @var SubdomainRepository */
+    protected $subdomainRepository;
+
+    /** @var UserRepository */
+    protected $userRepository;
+
+    public function __construct(UserRepository $userRepository, SubdomainRepository $subdomainRepository)
+    {
+        $this->userRepository = $userRepository;
+        $this->subdomainRepository = $subdomainRepository;
+    }
+
+    public function handle(Request $request, ConnectionInterface $httpConnection)
+    {
+        $validator = Validator::make($request->all(), [
+            'subdomain' => 'required',
+        ], [
+            'required' => 'The :attribute field is required.',
+        ]);
+
+        if ($validator->fails()) {
+            $httpConnection->send(respond_json(['errors' => $validator->getMessageBag()], 401));
+            $httpConnection->close();
+
+            return;
+        }
+
+        $this->userRepository->getUserByToken($request->get('auth_token', ''))
+            ->then(function ($user) use ($httpConnection, $request) {
+                if (is_null($user)) {
+                    $httpConnection->send(respond_json(['error' => 'The user does not exist'], 404));
+                    $httpConnection->close();
+
+                    return;
+                }
+
+                if ($user['can_specify_subdomains'] === 0) {
+                    $httpConnection->send(respond_json(['error' => 'The user is not allowed to reserve subdomains.'], 401));
+                    $httpConnection->close();
+
+                    return;
+                }
+
+                $insertData = [
+                    'user_id' => $user['id'],
+                    'subdomain' => $request->get('subdomain'),
+                ];
+
+                $this->subdomainRepository
+                    ->storeSubdomain($insertData)
+                    ->then(function ($subdomain) use ($httpConnection) {
+                        if (is_null($subdomain)) {
+                            $httpConnection->send(respond_json(['error' => 'The subdomain is already taken.'], 422));
+                            $httpConnection->close();
+
+                            return;
+                        }
+                        $httpConnection->send(respond_json(['subdomain' => $subdomain], 200));
+                        $httpConnection->close();
+                    });
+            });
+    }
+}

app/Server/Http/Controllers/ControlMessageController.php

@@ -3,6 +3,7 @@
 namespace App\Server\Http\Controllers;
 
 use App\Contracts\ConnectionManager;
+use App\Contracts\SubdomainRepository;
 use App\Contracts\UserRepository;
 use App\Http\QueryParameters;
 use App\Server\Exceptions\NoFreePortAvailable;
@@ -20,10 +21,14 @@ class ControlMessageController implements MessageComponentInterface
     /** @var UserRepository */
     protected $userRepository;
 
-    public function __construct(ConnectionManager $connectionManager, UserRepository $userRepository)
+    /** @var SubdomainRepository */
+    protected $subdomainRepository;
+
+    public function __construct(ConnectionManager $connectionManager, UserRepository $userRepository, SubdomainRepository $subdomainRepository)
     {
         $this->connectionManager = $connectionManager;
         $this->userRepository = $userRepository;
+        $this->subdomainRepository = $subdomainRepository;
     }
 
     /**
@@ -100,10 +105,13 @@ class ControlMessageController implements MessageComponentInterface
 
     protected function handleHttpConnection(ConnectionInterface $connection, $data, $user = null)
     {
-        if (! $this->hasValidSubdomain($connection, $data->subdomain, $user)) {
+        $this->hasValidSubdomain($connection, $data->subdomain, $user)->then(function ($subdomain) use ($data, $connection) {
+            if ($subdomain === false) {
                 return;
             }
 
+            $data->subdomain = $subdomain;
+
             $connectionInfo = $this->connectionManager->storeConnection($data->host, $data->subdomain, $connection);
 
             $this->connectionManager->limitConnectionLength($connectionInfo, config('expose.admin.maximum_connection_length'));
@@ -116,6 +124,7 @@ class ControlMessageController implements MessageComponentInterface
                     'client_id' => $connectionInfo->client_id,
                 ],
             ]));
+        });
     }
 
     protected function handleTcpConnection(ConnectionInterface $connection, $data, $user = null)
@@ -203,22 +212,45 @@ class ControlMessageController implements MessageComponentInterface
         return $deferred->promise();
     }
 
-    protected function hasValidSubdomain(ConnectionInterface $connection, ?string $subdomain, ?array $user): bool
+    protected function hasValidSubdomain(ConnectionInterface $connection, ?string $subdomain, ?array $user): PromiseInterface
     {
+        /**
+         * Check if the user can specify a custom subdomain in the first place.
+         */
         if (! is_null($user) && $user['can_specify_subdomains'] === 0 && ! is_null($subdomain)) {
+            $connection->send(json_encode([
+                'event' => 'info',
+                'data' => [
+                    'message' => config('expose.admin.messages.custom_subdomain_unauthorized').PHP_EOL,
+                ],
+            ]));
+
+            return \React\Promise\resolve(null);
+        }
+
+        /**
+         * Check if the given subdomain is reserved for a different user.
+         */
+        if (! is_null($subdomain)) {
+            return $this->subdomainRepository->getSubdomainByName($subdomain)
+                ->then(function ($foundSubdomain) use ($connection, $subdomain, $user) {
+                    if (! is_null($foundSubdomain) && ! is_null($user) && $foundSubdomain['user_id'] !== $user['id']) {
+                        $message = config('expose.admin.messages.subdomain_reserved');
+                        $message = str_replace(':subdomain', $subdomain, $message);
+
                         $connection->send(json_encode([
                             'event' => 'subdomainTaken',
                             'data' => [
-                    'message' => config('expose.admin.messages.custom_subdomain_unauthorized'),
+                                'message' => $message,
                             ],
                         ]));
                         $connection->close();
 
-            return false;
+                        return \React\Promise\resolve(false);
                     }
 
-        if (! is_null($subdomain)) {
                     $controlConnection = $this->connectionManager->findControlConnectionForSubdomain($subdomain);
+
                     if (! is_null($controlConnection) || $subdomain === config('expose.admin.subdomain')) {
                         $message = config('expose.admin.messages.subdomain_taken');
                         $message = str_replace(':subdomain', $subdomain, $message);
@@ -231,11 +263,14 @@ class ControlMessageController implements MessageComponentInterface
                         ]));
                         $connection->close();
 
-                return false;
-            }
+                        return \React\Promise\resolve(false);
                     }
 
-        return true;
+                    return \React\Promise\resolve($subdomain);
+                });
+        }
+
+        return \React\Promise\resolve($subdomain);
     }
 
     protected function canShareTcpPorts(ConnectionInterface $connection, $data, $user)

app/Server/Http/Controllers/TunnelMessageController.php

@@ -75,7 +75,7 @@ class TunnelMessageController extends Controller
 
         $httpConnection = $this->connectionManager->storeHttpConnection($httpConnection, $requestId);
 
-        transform($this->passRequestThroughModifiers($request, $httpConnection), function (Request $request) use ($controlConnection , $requestId) {
+        transform($this->passRequestThroughModifiers($request, $httpConnection), function (Request $request) use ($controlConnection, $requestId) {
             $controlConnection->once('proxy_ready_'.$requestId, function (ConnectionInterface $proxy) use ($request) {
                 // Convert the Laravel request into a PSR7 request
                 $psr17Factory = new Psr17Factory();
@@ -113,9 +113,13 @@ class TunnelMessageController extends Controller
             $host .= ":{$this->configuration->port()}";
         }
 
-        $request->headers->set('Host', $controlConnection->host);
+        $exposeUrl = parse_url($controlConnection->host);
+
+        $request->headers->set('Host', "{$controlConnection->subdomain}.{$host}");
         $request->headers->set('X-Forwarded-Proto', $request->isSecure() ? 'https' : 'http');
-        $request->headers->set('X-Expose-Request-ID', uniqid());
+        $request->headers->set('X-Expose-Request-ID', sha1(uniqid('', true)));
+        $request->headers->set('X-Expose-Host', sprintf('%s:%s', $exposeUrl['host'], $exposeUrl['port']));
+        $request->headers->set('X-Expose-Proto', $exposeUrl['scheme']);
         $request->headers->set('Upgrade-Insecure-Requests', 1);
         $request->headers->set('X-Exposed-By', config('app.name').' '.config('app.version'));
         $request->headers->set('X-Original-Host', "{$controlConnection->subdomain}.{$host}");

app/Server/SubdomainRepository/DatabaseSubdomainRepository.php

@@ -0,0 +1,132 @@
+<?php
+
+namespace App\Server\SubdomainRepository;
+
+use App\Contracts\SubdomainRepository;
+use Clue\React\SQLite\DatabaseInterface;
+use Clue\React\SQLite\Result;
+use React\Promise\Deferred;
+use React\Promise\PromiseInterface;
+
+class DatabaseSubdomainRepository implements SubdomainRepository
+{
+    /** @var DatabaseInterface */
+    protected $database;
+
+    public function __construct(DatabaseInterface $database)
+    {
+        $this->database = $database;
+    }
+
+    public function getSubdomains(): PromiseInterface
+    {
+        $deferred = new Deferred();
+
+        $this->database
+            ->query('SELECT * FROM subdomains ORDER by created_at DESC')
+            ->then(function (Result $result) use ($deferred) {
+                $deferred->resolve($result->rows);
+            });
+
+        return $deferred->promise();
+    }
+
+    public function getSubdomainById($id): PromiseInterface
+    {
+        $deferred = new Deferred();
+
+        $this->database
+            ->query('SELECT * FROM subdomains WHERE id = :id', ['id' => $id])
+            ->then(function (Result $result) use ($deferred) {
+                $deferred->resolve($result->rows[0] ?? null);
+            });
+
+        return $deferred->promise();
+    }
+
+    public function getSubdomainByName(string $name): PromiseInterface
+    {
+        $deferred = new Deferred();
+
+        $this->database
+            ->query('SELECT * FROM subdomains WHERE subdomain = :name', ['name' => $name])
+            ->then(function (Result $result) use ($deferred) {
+                $deferred->resolve($result->rows[0] ?? null);
+            });
+
+        return $deferred->promise();
+    }
+
+    public function getSubdomainsByUserId($id): PromiseInterface
+    {
+        $deferred = new Deferred();
+
+        $this->database
+            ->query('SELECT * FROM subdomains WHERE user_id = :user_id ORDER by created_at DESC', [
+                'user_id' => $id,
+            ])
+            ->then(function (Result $result) use ($deferred) {
+                $deferred->resolve($result->rows);
+            });
+
+        return $deferred->promise();
+    }
+
+    public function storeSubdomain(array $data): PromiseInterface
+    {
+        $deferred = new Deferred();
+
+        $this->getSubdomainByName($data['subdomain'])
+            ->then(function ($registeredSubdomain) use ($data, $deferred) {
+                if (! is_null($registeredSubdomain)) {
+                    $deferred->resolve(null);
+
+                    return;
+                }
+
+                $this->database->query("
+                    INSERT INTO subdomains (user_id, subdomain, created_at)
+                    VALUES (:user_id, :subdomain, DATETIME('now'))
+                ", $data)
+                    ->then(function (Result $result) use ($deferred) {
+                        $this->database->query('SELECT * FROM subdomains WHERE id = :id', ['id' => $result->insertId])
+                            ->then(function (Result $result) use ($deferred) {
+                                $deferred->resolve($result->rows[0]);
+                            });
+                    });
+            });
+
+        return $deferred->promise();
+    }
+
+    public function getSubdomainsByUserIdAndName($id, $name): PromiseInterface
+    {
+        $deferred = new Deferred();
+
+        $this->database
+            ->query('SELECT * FROM subdomains WHERE user_id = :user_id AND subdomain = :name ORDER by created_at DESC', [
+                'user_id' => $id,
+                'name' => $name,
+            ])
+            ->then(function (Result $result) use ($deferred) {
+                $deferred->resolve($result->rows);
+            });
+
+        return $deferred->promise();
+    }
+
+    public function deleteSubdomainForUserId($userId, $subdomainId): PromiseInterface
+    {
+        $deferred = new Deferred();
+
+        $this->database->query('DELETE FROM subdomains WHERE id = :id AND user_id = :user_id', [
+            'id' => $subdomainId,
+            'user_id' => $userId,
+        ])
+            ->then(function (Result $result) use ($deferred) {
+                $deferred->resolve($result);
+            });
+
+        return $deferred->promise();
+    }
+}

config/expose.php

@@ -232,6 +232,8 @@ return [
         */
         'user_repository' => \App\Server\UserRepository\DatabaseUserRepository::class,
 
+        'subdomain_repository' => \App\Server\SubdomainRepository\DatabaseSubdomainRepository::class,
+
         /*
         |--------------------------------------------------------------------------
         | Messages
@@ -249,7 +251,7 @@ return [
 
             'subdomain_taken' => 'The chosen subdomain :subdomain is already taken. Please choose a different subdomain.',
 
-            'custom_subdomain_unauthorized' => 'You are not allowed to specify custom subdomains. Please upgrade to Expose Pro.',
+            'custom_subdomain_unauthorized' => 'You are not allowed to specify custom subdomains. Please upgrade to Expose Pro. Assigning a random subdomain instead.',
 
             'no_free_tcp_port_available' => 'There are no free TCP ports available on this server. Please try again later.',
         ],

database/migrations/04_create_subdomains_table.sql

@@ -0,0 +1,7 @@
+CREATE TABLE IF NOT EXISTS subdomains (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    subdomain STRING NOT NULL,
+    created_at DATETIME,
+    updated_at DATETIME
+)

docs/client/configuration.md

@@ -17,6 +17,12 @@ The configuration file will be written to your home directory inside a `.expose`
 
 `~/.expose/config.php`
 
+You can also provide a custom location of the config file by providing the full path as a server variable.
+
+```bash
+EXPOSE_CONFIG_FILE="~/my-custom-config.php" expose share
+```
+
 And the default content of the configuration file is this:
 
 ```php

tests/Feature/Client/DashboardTest.php

@@ -2,6 +2,7 @@
 
 namespace Tests\Feature\Client;
 
+use App\Client\Configuration;
 use App\Client\Factory;
 use App\Client\Http\HttpClient;
 use App\Logger\LoggedRequest;
@@ -129,6 +130,10 @@ class DashboardTest extends TestCase
 
     protected function startDashboard()
     {
+        app()->singleton(Configuration::class, function ($app) {
+            return new Configuration('localhost', '8080', false);
+        });
+
         $this->dashboardFactory = (new Factory())
             ->setLoop($this->loop)
             ->createHttpServer();

tests/Feature/Server/ApiTest.php

@@ -5,6 +5,7 @@ namespace Tests\Feature\Server;
 use App\Contracts\ConnectionManager;
 use App\Server\Factory;
 use Clue\React\Buzz\Browser;
+use Clue\React\Buzz\Message\ResponseException;
 use GuzzleHttp\Psr7\Response;
 use Nyholm\Psr7\Request;
 use Ratchet\Server\IoConnection;
@@ -65,10 +66,10 @@ class ApiTest extends TestCase
     }
 
     /** @test */
-    public function it_can_get_user_details()
+    public function it_does_not_allow_subdomain_reservation_for_users_without_the_right_flag()
     {
         /** @var Response $response */
-        $this->await($this->browser->post('http://127.0.0.1:8080/api/users', [
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/users', [
             'Host' => 'expose.localhost',
             'Authorization' => base64_encode('username:secret'),
             'Content-Type' => 'application/json',
@@ -76,6 +77,72 @@ class ApiTest extends TestCase
             'name' => 'Marcel',
         ])));
 
+        $user = json_decode($response->getBody()->getContents())->user;
+
+        $this->expectException(ResponseException::class);
+        $this->expectExceptionMessage('HTTP status code 401');
+
+        $this->await($this->browser->post('http://127.0.0.1:8080/api/subdomains', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'auth_token' => $user->auth_token,
+            'subdomain' => 'reserved',
+        ])));
+    }
+
+    /** @test */
+    public function it_allows_subdomain_reservation_for_users_with_the_right_flag()
+    {
+        /** @var Response $response */
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/users', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'name' => 'Marcel',
+            'can_specify_subdomains' => 1,
+        ])));
+
+        $user = json_decode($response->getBody()->getContents())->user;
+
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/subdomains', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'auth_token' => $user->auth_token,
+            'subdomain' => 'reserved',
+        ])));
+
+        $this->assertSame(200, $response->getStatusCode());
+    }
+
+    /** @test */
+    public function it_can_get_user_details()
+    {
+        /** @var Response $response */
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/users', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'name' => 'Marcel',
+            'can_specify_subdomains' => 1,
+        ])));
+
+        $user = json_decode($response->getBody()->getContents())->user;
+
+        $this->await($this->browser->post('http://127.0.0.1:8080/api/subdomains', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'auth_token' => $user->auth_token,
+            'subdomain' => 'reserved',
+        ])));
+
         /** @var Response $response */
         $response = $this->await($this->browser->get('http://127.0.0.1:8080/api/users/1', [
             'Host' => 'expose.localhost',
@@ -85,10 +152,117 @@ class ApiTest extends TestCase
 
         $body = json_decode($response->getBody()->getContents());
         $user = $body->user;
+        $subdomains = $body->subdomains;
 
         $this->assertSame('Marcel', $user->name);
         $this->assertSame([], $user->sites);
         $this->assertSame([], $user->tcp_connections);
+
+        $this->assertCount(1, $subdomains);
+    }
+
+    /** @test */
+    public function it_can_delete_subdomains()
+    {
+        /** @var Response $response */
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/users', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'name' => 'Marcel',
+            'can_specify_subdomains' => 1,
+        ])));
+
+        $user = json_decode($response->getBody()->getContents())->user;
+
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/subdomains', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'subdomain' => 'reserved',
+            'auth_token' => $user->auth_token,
+        ])));
+
+        $this->await($this->browser->delete('http://127.0.0.1:8080/api/subdomains/1', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'auth_token' => $user->auth_token,
+        ])));
+
+        /** @var Response $response */
+        $response = $this->await($this->browser->get('http://127.0.0.1:8080/api/users/1', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ]));
+
+        $body = json_decode($response->getBody()->getContents());
+        $subdomains = $body->subdomains;
+
+        $this->assertCount(0, $subdomains);
+    }
+
+    /** @test */
+    public function it_can_not_reserve_an_already_reserved_subdomain()
+    {
+        /** @var Response $response */
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/users', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'name' => 'Marcel',
+            'can_specify_subdomains' => 1,
+        ])));
+
+        $user = json_decode($response->getBody()->getContents())->user;
+
+        $this->await($this->browser->post('http://127.0.0.1:8080/api/subdomains', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'subdomain' => 'reserved',
+            'auth_token' => $user->auth_token,
+        ])));
+
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/users', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'name' => 'Sebastian',
+            'can_specify_subdomains' => 1,
+        ])));
+
+        $user = json_decode($response->getBody()->getContents())->user;
+
+        $this->expectException(ResponseException::class);
+        $this->expectExceptionMessage('HTTP status code 422');
+
+        $this->await($this->browser->post('http://127.0.0.1:8080/api/subdomains', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'subdomain' => 'reserved',
+            'auth_token' => $user->auth_token,
+        ])));
+
+        $response = $this->await($this->browser->get('http://127.0.0.1:8080/api/users/2', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ]));
+
+        $body = json_decode($response->getBody()->getContents());
+        $subdomains = $body->subdomains;
+
+        $this->assertCount(0, $subdomains);
     }
 
     /** @test */

tests/Feature/Server/TunnelTest.php

@@ -235,8 +235,6 @@ class TunnelTest extends TestCase
             'can_specify_subdomains' => 0,
         ])));
 
-        $this->expectException(\UnexpectedValueException::class);
-
         $user = json_decode($response->getBody()->getContents())->user;
 
         $this->createTestHttpServer();
@@ -248,7 +246,92 @@ class TunnelTest extends TestCase
         $client = $this->createClient();
         $response = $this->await($client->connectToServer('127.0.0.1:8085', 'tunnel', $user->auth_token));
 
-        $this->assertSame('tunnel', $response->subdomain);
+        $this->assertNotSame('tunnel', $response->subdomain);
+    }
+
+    /** @test */
+    public function it_rejects_users_that_want_to_use_a_reserved_subdomain()
+    {
+        $this->app['config']['expose.admin.validate_auth_tokens'] = true;
+
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/users', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'name' => 'Marcel',
+            'can_specify_subdomains' => 1,
+        ])));
+
+        $user = json_decode($response->getBody()->getContents())->user;
+
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/subdomains', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'subdomain' => 'reserved',
+            'auth_token' => $user->auth_token,
+        ])));
+
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/users', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'name' => 'Test-User',
+            'can_specify_subdomains' => 1,
+        ])));
+
+        $user = json_decode($response->getBody()->getContents())->user;
+
+        $this->createTestHttpServer();
+
+        $this->expectException(\UnexpectedValueException::class);
+        /**
+         * We create an expose client that connects to our server and shares
+         * the created test HTTP server.
+         */
+        $client = $this->createClient();
+        $response = $this->await($client->connectToServer('127.0.0.1:8085', 'reserved', $user->auth_token));
+
+        $this->assertSame('reserved', $response->subdomain);
+    }
+
+    /** @test */
+    public function it_allows_users_to_use_their_own_reserved_subdomains()
+    {
+        $this->app['config']['expose.admin.validate_auth_tokens'] = true;
+
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/users', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'name' => 'Marcel',
+            'can_specify_subdomains' => 1,
+        ])));
+
+        $user = json_decode($response->getBody()->getContents())->user;
+
+        $response = $this->await($this->browser->post('http://127.0.0.1:8080/api/subdomains', [
+            'Host' => 'expose.localhost',
+            'Authorization' => base64_encode('username:secret'),
+            'Content-Type' => 'application/json',
+        ], json_encode([
+            'subdomain' => 'reserved',
+            'auth_token' => $user->auth_token,
+        ])));
+
+        $this->createTestHttpServer();
+        /**
+         * We create an expose client that connects to our server and shares
+         * the created test HTTP server.
+         */
+        $client = $this->createClient();
+        $response = $this->await($client->connectToServer('127.0.0.1:8085', 'reserved', $user->auth_token));
+
+        $this->assertSame('reserved', $response->subdomain);
     }
 
     /** @test */