You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Khoa Nguyen <kh...@gmail.com> on 2005/08/18 21:23:17 UTC
[users@httpd] Host header field: How is it enforced or not at all?
Hi,
I don't quite understand the use of the Host: header field in HTTP
1.1request. For example, I wrote a simple script to connect to
www.google.com <http://www.google.com> on port 80. After the connection, I
send the following GET request:
GET / HTTP/1.1
Host: whatever.com <http://whatever.com>
...
The web server doesn't seem to care what I put in the Host field and always
returns the google home page. Is this behaviour acceptable? Why a HTTP
1.1web server insists on the presence of a Host field but doesn't seem
to do
any kind of checking on it?
Thanks,
Khoa
Re: [users@httpd] Host header field: How is it enforced or not at all?
Posted by Joshua Slive <js...@gmail.com>.
On 8/18/05, William A. Rowe, Jr. <wr...@rowe-clan.net> wrote:
> Why is that your issue? This is how google configured their servers.
>
> Read the NameVirtualHost directive; all requests to an unrecognized
> host will be routed to the first (default) named virtual host in the
> config.
>
> You didn't expect Host: to act as some proxy service, did you?
Also see:
http://httpd.apache.org/docs/1.3/misc/FAQ.html#proxyscan
which addresses a slightly different issue, but shows you how to deny
these types of requests if you want.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Host header field: How is it enforced or not at
all?
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Why is that your issue? This is how google configured their servers.
Read the NameVirtualHost directive; all requests to an unrecognized
host will be routed to the first (default) named virtual host in the
config.
You didn't expect Host: to act as some proxy service, did you?
Khoa Nguyen wrote:
> Hi,
>
> I don't quite understand the use of the Host: header field in HTTP 1.1
> request. For example, I wrote a simple script to connect to
> www.google.com <http://www.google.com> on port 80. After the connection,
> I send the following GET request:
>
> GET / HTTP/1.1
> Host: whatever.com <http://whatever.com>
> ...
>
> The web server doesn't seem to care what I put in the Host field and
> always returns the google home page. Is this behaviour acceptable? Why a
> HTTP 1.1 web server insists on the presence of a Host field but doesn't
> seem to do any kind of checking on it?
>
> Thanks,
> Khoa
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Host header field: How is it enforced or not at all?
Posted by Khoa Nguyen <kh...@gmail.com>.
Thank you. That does the trick quite nicely!
Khoa
On 8/18/05, Ivan Barrera A. <Br...@ivn.cl> wrote:
>
> Khoa Nguyen wrote:
> > Thanks for your quick response. I have tried to configure two name-based
> > virtual hosts on my server machine: server5.com <http://server5.com> <
> http://server5.com> and
> > server6.com <http://server6.com> <http://server6.com>. In the request, I
> specified "Host:
> > whatever.com <http://whatever.com> <http://whatever.com>". The server
> still sends a page back
> > from server5.com <http://server5.com> <http://server5.com>. How do I
> enforce the server to
> > send some negative message (e.g. 404 Not Found) back to the client if
> > the Host: field value is not configured on the server as a virtual host?
>
>
> In apache, you must create a default vhost which points to an error
> message.
> The first virtual host becomes the default, so define a virtual host
> before www.server5.com <http://www.server5.com> that points to the page
> containing the message.
>
> ;)
>
> >
> > Thanks,
> > Khoa
> >
> > On 8/18/05, *Ivan Barrera A.* <Bruce@ivn.cl <ma...@ivn.cl>>
> wrote:
> >
> > Khoa Nguyen wrote:
> > > Hi,
> > >
> > > I don't quite understand the use of the Host: header field in HTTP 1.1
> > > request. For example, I wrote a simple script to connect to
> > > www.google.com <http://www.google.com> <http://www.google.com> <
> http://www.google.com> on
> > port 80. After the connection,
> > > I send the following GET request:
> > >
> > > GET / HTTP/1.1
> > > Host: whatever.com <http://whatever.com> <http://whatever.com> <
> http://whatever.com>
> > > ...
> > >
> > > The web server doesn't seem to care what I put in the Host field and
> > > always returns the google home page. Is this behaviour acceptable?
> > Why a
> > > HTTP 1.1 web server insists on the presence of a Host field but
> > doesn't
> > > seem to do any kind of checking on it?
> >
> > What if you have the same index for all vhosts ?
> > What if you are using just 1 vhost (so, the default one) ?
> >
> > It isn't a matter of HTTP/1.1 spec. It is a matter on how you configure
> > your webserver.
> >
> > >
> > > Thanks,
> > > Khoa
> >
> > ---------------------------------------------------------------------
> > The official User-To-User support forum of the Apache HTTP Server
> > Project.
> > See <URL:http://httpd.apache.org/userslist.html> for more info.
> > To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> > <ma...@httpd.apache.org>
> > " from the digest: users-digest-unsubscribe@httpd.apache.org
> > <ma...@httpd.apache.org>
> > For additional commands, e-mail: users-help@httpd.apache.org
> > <ma...@httpd.apache.org>
> >
> >
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
[users@httpd] Password protecting a directory without .htaccess
Posted by theshz <th...@gmail.com>.
Hi, I'm trying to password protect a directory. The usual approach is to use
.htaccess files, which requires BasicAuthentication. The problem I have is
that my website already has a custom login/logout feature, so I can't ask
the user to type in name/password again to access the protected directory.
When the user is logged in, I'm keeping a variable in the session to
indicate that, I'd like to check this variable to allow/disallow access to
the directory. How can I achieve this?
(This seems to be the common feature out there, I think very few are using
the BasicAuthentication's usual popup window to enter name/password, instead
almost every site has their own login/logout page. How do they allow access
to some static contents?)
Thanks.
theshz
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Host header field: How is it enforced or not at
all?
Posted by "Ivan Barrera A." <Br...@Ivn.cl>.
Khoa Nguyen wrote:
> Thanks for your quick response. I have tried to configure two name-based
> virtual hosts on my server machine: server5.com <http://server5.com> and
> server6.com <http://server6.com>. In the request, I specified "Host:
> whatever.com <http://whatever.com>". The server still sends a page back
> from server5.com <http://server5.com>. How do I enforce the server to
> send some negative message (e.g. 404 Not Found) back to the client if
> the Host: field value is not configured on the server as a virtual host?
In apache, you must create a default vhost which points to an error message.
The first virtual host becomes the default, so define a virtual host
before www.server5.com that points to the page containing the message.
;)
>
> Thanks,
> Khoa
>
> On 8/18/05, *Ivan Barrera A.* <Bruce@ivn.cl <ma...@ivn.cl>> wrote:
>
> Khoa Nguyen wrote:
> > Hi,
> >
> > I don't quite understand the use of the Host: header field in HTTP 1.1
> > request. For example, I wrote a simple script to connect to
> > www.google.com <http://www.google.com> <http://www.google.com> on
> port 80. After the connection,
> > I send the following GET request:
> >
> > GET / HTTP/1.1
> > Host: whatever.com <http://whatever.com> <http://whatever.com>
> > ...
> >
> > The web server doesn't seem to care what I put in the Host field and
> > always returns the google home page. Is this behaviour acceptable?
> Why a
> > HTTP 1.1 web server insists on the presence of a Host field but
> doesn't
> > seem to do any kind of checking on it?
>
> What if you have the same index for all vhosts ?
> What if you are using just 1 vhost (so, the default one) ?
>
> It isn't a matter of HTTP/1.1 spec. It is a matter on how you configure
> your webserver.
>
> >
> > Thanks,
> > Khoa
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> <ma...@httpd.apache.org>
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> <ma...@httpd.apache.org>
> For additional commands, e-mail: users-help@httpd.apache.org
> <ma...@httpd.apache.org>
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Host header field: How is it enforced or not at all?
Posted by Khoa Nguyen <kh...@gmail.com>.
Thanks for your quick response. I have tried to configure two name-based
virtual hosts on my server machine: server5.com <http://server5.com> and
server6.com <http://server6.com>. In the request, I specified "Host:
whatever.com <http://whatever.com>". The server still sends a page back from
server5.com <http://server5.com>. How do I enforce the server to send some
negative message (e.g. 404 Not Found) back to the client if the Host: field
value is not configured on the server as a virtual host?
Thanks,
Khoa
On 8/18/05, Ivan Barrera A. <Br...@ivn.cl> wrote:
>
> Khoa Nguyen wrote:
> > Hi,
> >
> > I don't quite understand the use of the Host: header field in HTTP 1.1
> > request. For example, I wrote a simple script to connect to
> > www.google.com <http://www.google.com> <http://www.google.com> on port
> 80. After the connection,
> > I send the following GET request:
> >
> > GET / HTTP/1.1
> > Host: whatever.com <http://whatever.com> <http://whatever.com>
> > ...
> >
> > The web server doesn't seem to care what I put in the Host field and
> > always returns the google home page. Is this behaviour acceptable? Why a
> > HTTP 1.1 web server insists on the presence of a Host field but doesn't
> > seem to do any kind of checking on it?
>
> What if you have the same index for all vhosts ?
> What if you are using just 1 vhost (so, the default one) ?
>
> It isn't a matter of HTTP/1.1 spec. It is a matter on how you configure
> your webserver.
>
> >
> > Thanks,
> > Khoa
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Re: [users@httpd] Host header field: How is it enforced or not at
all?
Posted by "Ivan Barrera A." <Br...@Ivn.cl>.
Khoa Nguyen wrote:
> Hi,
>
> I don't quite understand the use of the Host: header field in HTTP 1.1
> request. For example, I wrote a simple script to connect to
> www.google.com <http://www.google.com> on port 80. After the connection,
> I send the following GET request:
>
> GET / HTTP/1.1
> Host: whatever.com <http://whatever.com>
> ...
>
> The web server doesn't seem to care what I put in the Host field and
> always returns the google home page. Is this behaviour acceptable? Why a
> HTTP 1.1 web server insists on the presence of a Host field but doesn't
> seem to do any kind of checking on it?
What if you have the same index for all vhosts ?
What if you are using just 1 vhost (so, the default one) ?
It isn't a matter of HTTP/1.1 spec. It is a matter on how you configure
your webserver.
>
> Thanks,
> Khoa
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org