Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7764 > unrolled thread

When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script?

Back to article view | Back to comp.lang.php

Contents

  When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-11 10:53 +0000
    Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Scott Johnson <noonehome@chalupasworld.com> - 2012-12-11 05:28 -0800
      Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Paul Herber <paul@pherber.com> - 2012-12-11 14:01 +0000
        Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-12 13:05 +0000
      Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-12 07:25 +0000
        Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Scott Johnson <noonehome@chalupasworld.com> - 2012-12-12 05:27 -0800
          Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-12 17:22 +0000
            Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2012-12-12 10:50 -0800
              Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? The Natural Philosopher <tnp@invalid.invalid> - 2012-12-12 19:34 +0000
                Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-13 06:52 +0000
                  Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Anders Wegge Keller <wegge@wegge.dk> - 2012-12-13 08:02 +0100
                  Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? The Natural Philosopher <tnp@invalid.invalid> - 2012-12-13 11:43 +0000
    Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-11 17:26 +0100
      Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-12 13:10 +0000
    Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Christoph Becker <cmbecker69@gmx.de> - 2012-12-12 13:11 +0100
      Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-12 13:00 +0000

#7764 — When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script?

I always understood than when activated through a web browser that 
$_SERVER['SERVER_NAME'] and $_SERVER['HTTP_HOST'] identified the domain name 
under which the script was being run, but I have come across some instances 
where both SERVER_NAME and HTTP_HOST appear to be spoofed, and I wondered if 
this is legitimate or not.

I have an application which exists on a live server and a test server, with 
a different database for each, and they both share a common config file 
which identifies which server it is running on so that it can use the 
relevant database credentials. If the server name does not match either of 
the live or test domain names (such as mydomain.com and test.mydomain.com) 
then it uses invalid credentials which causes an error when attempting to 
access the database. I never though that this error would ever appear, but 
lately I have been getting errors such as the following:

Fatal Error: mysqli_connect(): Access denied for user 'default'@'localhost' 
(using password: YES).
Error in line 259 of file 
'/var/www/vhosts/mydomain.com/httpdocs/transix/includes/dml.mysqli.class.inc'.
PHP_SELF: /index.php
CURRENT DIRECTORY: /var/www/vhosts/mydomain.com/httpdocs
SERVER_ADDR: nnn.nnn.nnn.nnn
SERVER_NAME: www.yahoo.com
HTTP_HOST: www.yahoo.com
REMOTE_ADDR: 109.108.142.236
REQUEST_URI: http://www.yahoo.com/

In order to run this script on my live server the URL should have been 
www.mydomain.com but here you can see it reported as www.yahoo.com. How is 
this possible?

Tony Marston

http://www.tonymarston.net
http://www.radicore.org 

[toc] | [next] | [standalone]

#7766

On 12/11/2012 2:53 AM, Tony Marston wrote:
> I always understood than when activated through a web browser that
> $_SERVER['SERVER_NAME'] and $_SERVER['HTTP_HOST'] identified the domain
> name under which the script was being run, but I have come across some
> instances where both SERVER_NAME and HTTP_HOST appear to be spoofed, and
> I wondered if this is legitimate or not.
>
> I have an application which exists on a live server and a test server,
> with a different database for each, and they both share a common config
> file which identifies which server it is running on so that it can use
> the relevant database credentials. If the server name does not match
> either of the live or test domain names (such as mydomain.com and
> test.mydomain.com) then it uses invalid credentials which causes an
> error when attempting to access the database. I never though that this
> error would ever appear, but lately I have been getting errors such as
> the following:
>
> Fatal Error: mysqli_connect(): Access denied for user
> 'default'@'localhost' (using password: YES).
> Error in line 259 of file
> '/var/www/vhosts/mydomain.com/httpdocs/transix/includes/dml.mysqli.class.inc'.
>
> PHP_SELF: /index.php
> CURRENT DIRECTORY: /var/www/vhosts/mydomain.com/httpdocs
> SERVER_ADDR: nnn.nnn.nnn.nnn
> SERVER_NAME: www.yahoo.com
> HTTP_HOST: www.yahoo.com
> REMOTE_ADDR: 109.108.142.236
> REQUEST_URI: http://www.yahoo.com/
>
> In order to run this script on my live server the URL should have been
> www.mydomain.com but here you can see it reported as www.yahoo.com. How
> is this possible?
>
> Tony Marston
>
> http://www.tonymarston.net
> http://www.radicore.org

Not an expert but it sounds that maybe your server/PHP engine is not 
configured properly.

I know REQUEST_URI should NOT be counted on.

Who is your host provider?

You may try phpinfo() to get the full list of data/variables set by your 
server.  Some here may ask for that info to help you further.

Scotty

[toc] | [prev] | [next] | [standalone]

#7767

On Tue, 11 Dec 2012 05:28:36 -0800, Scott Johnson <noonehome@chalupasworld.com> wrote:

>On 12/11/2012 2:53 AM, Tony Marston wrote:
>> I always understood than when activated through a web browser that
>> $_SERVER['SERVER_NAME'] and $_SERVER['HTTP_HOST'] identified the domain
>> name under which the script was being run, but I have come across some
>> instances where both SERVER_NAME and HTTP_HOST appear to be spoofed, and
>> I wondered if this is legitimate or not.
>>
>> I have an application which exists on a live server and a test server,
>> with a different database for each, and they both share a common config
>> file which identifies which server it is running on so that it can use
>> the relevant database credentials. If the server name does not match
>> either of the live or test domain names (such as mydomain.com and
>> test.mydomain.com) then it uses invalid credentials which causes an
>> error when attempting to access the database. I never though that this
>> error would ever appear, but lately I have been getting errors such as
>> the following:
>>
>> Fatal Error: mysqli_connect(): Access denied for user
>> 'default'@'localhost' (using password: YES).
>> Error in line 259 of file
>> '/var/www/vhosts/mydomain.com/httpdocs/transix/includes/dml.mysqli.class.inc'.
>>
>> PHP_SELF: /index.php
>> CURRENT DIRECTORY: /var/www/vhosts/mydomain.com/httpdocs
>> SERVER_ADDR: nnn.nnn.nnn.nnn
>> SERVER_NAME: www.yahoo.com
>> HTTP_HOST: www.yahoo.com
>> REMOTE_ADDR: 109.108.142.236
>> REQUEST_URI: http://www.yahoo.com/
>>
>> In order to run this script on my live server the URL should have been
>> www.mydomain.com but here you can see it reported as www.yahoo.com. How
>> is this possible?
>>
>> Tony Marston
>>
>> http://www.tonymarston.net
>> http://www.radicore.org
>
>Not an expert but it sounds that maybe your server/PHP engine is not 
>configured properly.
>
>I know REQUEST_URI should NOT be counted on.
>
>Who is your host provider?
>
>You may try phpinfo() to get the full list of data/variables set by your 
>server.  Some here may ask for that info to help you further.
>
>Scotty

If this is a script to process a form then be aware that anything can call the script
(including webbots (good and bad), other web pages, anything. All incoming information
could be forged.



-- 
Regards, Paul Herber, Sandrila Ltd.
http://www.sandrila.co.uk/    twitter: @sandrilaLtd      

[toc] | [prev] | [next] | [standalone]

#7787

"Paul Herber"  wrote in message 
news:sveec8dfsaseid5mqiv6cb5g3gro9euenn@news.eternal-september.org...
>
>On Tue, 11 Dec 2012 05:28:36 -0800, Scott Johnson 
><noonehome@chalupasworld.com> wrote:
>
>>On 12/11/2012 2:53 AM, Tony Marston wrote:
>>> I always understood than when activated through a web browser that
>>> $_SERVER['SERVER_NAME'] and $_SERVER['HTTP_HOST'] identified the domain
>>> name under which the script was being run, but I have come across some
>>> instances where both SERVER_NAME and HTTP_HOST appear to be spoofed, and
>>> I wondered if this is legitimate or not.
>>>
>>> I have an application which exists on a live server and a test server,
>>> with a different database for each, and they both share a common config
>>> file which identifies which server it is running on so that it can use
>>> the relevant database credentials. If the server name does not match
>>> either of the live or test domain names (such as mydomain.com and
>>> test.mydomain.com) then it uses invalid credentials which causes an
>>> error when attempting to access the database. I never though that this
>>> error would ever appear, but lately I have been getting errors such as
>>> the following:
>>>
>>> Fatal Error: mysqli_connect(): Access denied for user
>>> 'default'@'localhost' (using password: YES).
>>> Error in line 259 of file
>>> '/var/www/vhosts/mydomain.com/httpdocs/transix/includes/dml.mysqli.class.inc'.
>>>
>>> PHP_SELF: /index.php
>>> CURRENT DIRECTORY: /var/www/vhosts/mydomain.com/httpdocs
>>> SERVER_ADDR: nnn.nnn.nnn.nnn
>>> SERVER_NAME: www.yahoo.com
>>> HTTP_HOST: www.yahoo.com
>>> REMOTE_ADDR: 109.108.142.236
>>> REQUEST_URI: http://www.yahoo.com/
>>>
>>> In order to run this script on my live server the URL should have been
>>> www.mydomain.com but here you can see it reported as www.yahoo.com. How
>>> is this possible?
>>>
>>> Tony Marston
>>>
>>> http://www.tonymarston.net
>>> http://www.radicore.org
>>
>>Not an expert but it sounds that maybe your server/PHP engine is not
>>configured properly.
>>
>>I know REQUEST_URI should NOT be counted on.
>>
>>Who is your host provider?
>>
>>You may try phpinfo() to get the full list of data/variables set by your
>>server.  Some here may ask for that info to help you further.
>>
>>Scotty
>
>If this is a script to process a form then be aware that anything can call 
>the script
>(including webbots (good and bad), other web pages, anything. All incoming 
>information
>could be forged.
>

All my pages include the same config file in order the set the database 
connection parameters according to which version of the website is being 
used, live or test, but if the server name is not recognised as one of those 
two it causes an error. But if this value can be spoofed, how is it possible 
to identify, with absolute certainty, the name of the server on which the 
application is running?

-- 
Tony Marston

http://www.tonymarston.net
http://www.radicore.org 

[toc] | [prev] | [next] | [standalone]

#7784

"Scott Johnson"  wrote in message news:ka7ceh$vdf$1@dont-email.me...
>
>On 12/11/2012 2:53 AM, Tony Marston wrote:
>> I always understood than when activated through a web browser that
>> $_SERVER['SERVER_NAME'] and $_SERVER['HTTP_HOST'] identified the domain
>> name under which the script was being run, but I have come across some
>> instances where both SERVER_NAME and HTTP_HOST appear to be spoofed, and
>> I wondered if this is legitimate or not.
>>
>> I have an application which exists on a live server and a test server,
>> with a different database for each, and they both share a common config
>> file which identifies which server it is running on so that it can use
>> the relevant database credentials. If the server name does not match
>> either of the live or test domain names (such as mydomain.com and
>> test.mydomain.com) then it uses invalid credentials which causes an
>> error when attempting to access the database. I never though that this
>> error would ever appear, but lately I have been getting errors such as
>> the following:
>>
>> Fatal Error: mysqli_connect(): Access denied for user
>> 'default'@'localhost' (using password: YES).
>> Error in line 259 of file
>> '/var/www/vhosts/mydomain.com/httpdocs/transix/includes/dml.mysqli.class.inc'.
>>
>> PHP_SELF: /index.php
>> CURRENT DIRECTORY: /var/www/vhosts/mydomain.com/httpdocs
>> SERVER_ADDR: nnn.nnn.nnn.nnn
>> SERVER_NAME: www.yahoo.com
>> HTTP_HOST: www.yahoo.com
>> REMOTE_ADDR: 109.108.142.236
>> REQUEST_URI: http://www.yahoo.com/
>>
>> In order to run this script on my live server the URL should have been
>> www.mydomain.com but here you can see it reported as www.yahoo.com. How
>> is this possible?
>>
>> Tony Marston
>>
>> http://www.tonymarston.net
>> http://www.radicore.org
>
>Not an expert but it sounds that maybe your server/PHP engine is not 
>configured properly.
>
>I know REQUEST_URI should NOT be counted on.
>
>Who is your host provider?

This is a company that I have used for over 6 years for several different 
sites, and I have never had a problem previously. I can access all the sites 
with the correct URLs and they work as expected. I can even debug them 
remotely, and everything looks as it should.

>You may try phpinfo() to get the full list of data/variables set by your 
>server.  Some here may ask for that info to help you further.

The output from phpinfo() looks perfectly normal and correct. It shows the 
expected values for SERVER_NAME and HTTP_HOST.

>Scotty

-- 
Tony Marston

http://www.tonymarston.net
http://www.radicore.org 

[toc] | [prev] | [next] | [standalone]

#7789

On 12/11/2012 11:25 PM, Tony Marston wrote:

>> You may try phpinfo() to get the full list of data/variables set by
>> your server.  Some here may ask for that info to help you further.
>
> The output from phpinfo() looks perfectly normal and correct. It shows
> the expected values for SERVER_NAME and HTTP_HOST.
>

If you are getting the right value in SERVER_NAME and HTTP_HOST using 
phpinfo() but are then getting a different value when you use the same 
variable in your script, then you have an error in your script.

You may somewhere be setting the variables when you think you may be 
comparing them.

if(SERVER_NAME = 'blabla')...  set

if(SERVER_NAME == 'blabla')...  compare

[toc] | [prev] | [next] | [standalone]

#7790

"Scott Johnson"  wrote in message news:kaa0on$qjt$1@dont-email.me...
>
>On 12/11/2012 11:25 PM, Tony Marston wrote:
>
>>> You may try phpinfo() to get the full list of data/variables set by
>>> your server.  Some here may ask for that info to help you further.
>>
>> The output from phpinfo() looks perfectly normal and correct. It shows
>> the expected values for SERVER_NAME and HTTP_HOST.
>>
>
>If you are getting the right value in SERVER_NAME and HTTP_HOST using 
>phpinfo() but are then getting a different value when you use the same 
>variable in your script, then you have an error in your script.

These is no error in the script as it runs perfectly for thousands of 
requests, but occasionally it fails because $_SERVER['SERVER_NAME'] and 
$_SERVER['HOST_NAME'] contain values which are different from those which I 
expect and which are reported by phpinfo(). It appears that is *IS* possible 
for the client to spoof these values, as reported in 
http://shiflett.org/blog/2006/mar/server-name-versus-http-host

>You may somewhere be setting the variables when you think you may be 
>comparing them.
>
>if(SERVER_NAME = 'blabla')...  set
>
>if(SERVER_NAME == 'blabla')...  compare
>


-- 
Tony Marston

http://www.tonymarston.net
http://www.radicore.org 

[toc] | [prev] | [next] | [standalone]

#7791

On 12/12/12 9:22 AM, Tony Marston wrote:
> "Scott Johnson"  wrote in message news:kaa0on$qjt$1@dont-email.me...
>>
>> On 12/11/2012 11:25 PM, Tony Marston wrote:
>>
>>>> You may try phpinfo() to get the full list of data/variables set by
>>>> your server.  Some here may ask for that info to help you further.
>>>
>>> The output from phpinfo() looks perfectly normal and correct. It shows
>>> the expected values for SERVER_NAME and HTTP_HOST.
>>>
>>
>> If you are getting the right value in SERVER_NAME and HTTP_HOST using
>> phpinfo() but are then getting a different value when you use the same
>> variable in your script, then you have an error in your script.
>
> These is no error in the script as it runs perfectly for thousands of
> requests, but occasionally it fails because $_SERVER['SERVER_NAME'] and
> $_SERVER['HOST_NAME'] contain values which are different from those
> which I expect and which are reported by phpinfo(). It appears that is
> *IS* possible for the client to spoof these values, as reported in
> http://shiflett.org/blog/2006/mar/server-name-versus-http-host
>

The way that HTTP works, is that the client connects to the IP address, 
and then sends the host name it was trying to connect to as part of the 
headers.  eg. Host: www.example.com.  This allows for many virtual hosts 
on a single IP/Port.

What could happen is that someone's DNS is pointing to your IP, and so 
you receive a request that was meant for a different URL.

[toc] | [prev] | [next] | [standalone]

#7792

On 12/12/12 18:50, Daniel Pitts wrote:
> On 12/12/12 9:22 AM, Tony Marston wrote:
>> "Scott Johnson"  wrote in message news:kaa0on$qjt$1@dont-email.me...
>>>
>>> On 12/11/2012 11:25 PM, Tony Marston wrote:
>>>
>>>>> You may try phpinfo() to get the full list of data/variables set by
>>>>> your server.  Some here may ask for that info to help you further.
>>>>
>>>> The output from phpinfo() looks perfectly normal and correct. It shows
>>>> the expected values for SERVER_NAME and HTTP_HOST.
>>>>
>>>
>>> If you are getting the right value in SERVER_NAME and HTTP_HOST using
>>> phpinfo() but are then getting a different value when you use the same
>>> variable in your script, then you have an error in your script.
>>
>> These is no error in the script as it runs perfectly for thousands of
>> requests, but occasionally it fails because $_SERVER['SERVER_NAME'] and
>> $_SERVER['HOST_NAME'] contain values which are different from those
>> which I expect and which are reported by phpinfo(). It appears that is
>> *IS* possible for the client to spoof these values, as reported in
>> http://shiflett.org/blog/2006/mar/server-name-versus-http-host
>>
>
> The way that HTTP works, is that the client connects to the IP address,
> and then sends the host name it was trying to connect to as part of the
> headers.  eg. Host: www.example.com.  This allows for many virtual hosts
> on a single IP/Port.
>
> What could happen is that someone's DNS is pointing to your IP, and so
> you receive a request that was meant for a different URL.

all of which can be overcome by setting up the web server to reject or 
redirect requests that have the wrong 'host' parameter...

-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#7793

"The Natural Philosopher"  wrote in message 
news:kaam8e$n67$1@news.albasani.net...
>
>On 12/12/12 18:50, Daniel Pitts wrote:
>> On 12/12/12 9:22 AM, Tony Marston wrote:
>>> "Scott Johnson"  wrote in message news:kaa0on$qjt$1@dont-email.me...
>>>>
>>>> On 12/11/2012 11:25 PM, Tony Marston wrote:
>>>>
>>>>>> You may try phpinfo() to get the full list of data/variables set by
>>>>>> your server.  Some here may ask for that info to help you further.
>>>>>
>>>>> The output from phpinfo() looks perfectly normal and correct. It shows
>>>>> the expected values for SERVER_NAME and HTTP_HOST.
>>>>>
>>>>
>>>> If you are getting the right value in SERVER_NAME and HTTP_HOST using
>>>> phpinfo() but are then getting a different value when you use the same
>>>> variable in your script, then you have an error in your script.
>>>
>>> These is no error in the script as it runs perfectly for thousands of
>>> requests, but occasionally it fails because $_SERVER['SERVER_NAME'] and
>>> $_SERVER['HOST_NAME'] contain values which are different from those
>>> which I expect and which are reported by phpinfo(). It appears that is
>>> *IS* possible for the client to spoof these values, as reported in
>>> http://shiflett.org/blog/2006/mar/server-name-versus-http-host
>>>
>>
>> The way that HTTP works, is that the client connects to the IP address,
>> and then sends the host name it was trying to connect to as part of the
>> headers.  eg. Host: www.example.com.  This allows for many virtual hosts
>> on a single IP/Port.
>>
>> What could happen is that someone's DNS is pointing to your IP, and so
>> you receive a request that was meant for a different URL.
>
>all of which can be overcome by setting up the web server to reject or 
>redirect requests that have the wrong 'host' parameter...

And exactly how might that be done, O Great One?

-- 
Tony Marston

http://www.tonymarston.net
http://www.radicore.org 

[toc] | [prev] | [next] | [standalone]

#7794

"Tony Marston" <TonyMarston@hotmail.com> writes:

> "The Natural Philosopher"  wrote in message

>> all of which can be overcome by setting up the web server to reject
>> or redirect requests that have the wrong 'host' parameter...
 
> And exactly how might that be done, O Great One?

 With name-based virtual hosts, apache will match the name from the
request to the vhost. So setting up a wildcard match to catch requests
for hosts, not explicitliy definded, should match that requirement.

 Also, I suspect that the OP has a configuration directive similar to
"<VirtualHost *:80>", for these kind of problems to happen in the
first place.
 
-- 
/Wegge

Leder efter redundant peering af dk.*,linux.debian.*

[toc] | [prev] | [next] | [standalone]

#7795

On 13/12/12 06:52, Tony Marston wrote:
> "The Natural Philosopher"  wrote in message
> news:kaam8e$n67$1@news.albasani.net...
>>
>> On 12/12/12 18:50, Daniel Pitts wrote:
>>> On 12/12/12 9:22 AM, Tony Marston wrote:
>>>> "Scott Johnson"  wrote in message news:kaa0on$qjt$1@dont-email.me...
>>>>>
>>>>> On 12/11/2012 11:25 PM, Tony Marston wrote:
>>>>>
>>>>>>> You may try phpinfo() to get the full list of data/variables set by
>>>>>>> your server.  Some here may ask for that info to help you further.
>>>>>>
>>>>>> The output from phpinfo() looks perfectly normal and correct. It
>>>>>> shows
>>>>>> the expected values for SERVER_NAME and HTTP_HOST.
>>>>>>
>>>>>
>>>>> If you are getting the right value in SERVER_NAME and HTTP_HOST using
>>>>> phpinfo() but are then getting a different value when you use the same
>>>>> variable in your script, then you have an error in your script.
>>>>
>>>> These is no error in the script as it runs perfectly for thousands of
>>>> requests, but occasionally it fails because $_SERVER['SERVER_NAME'] and
>>>> $_SERVER['HOST_NAME'] contain values which are different from those
>>>> which I expect and which are reported by phpinfo(). It appears that is
>>>> *IS* possible for the client to spoof these values, as reported in
>>>> http://shiflett.org/blog/2006/mar/server-name-versus-http-host
>>>>
>>>
>>> The way that HTTP works, is that the client connects to the IP address,
>>> and then sends the host name it was trying to connect to as part of the
>>> headers.  eg. Host: www.example.com.  This allows for many virtual hosts
>>> on a single IP/Port.
>>>
>>> What could happen is that someone's DNS is pointing to your IP, and so
>>> you receive a request that was meant for a different URL.
>>
>> all of which can be overcome by setting up the web server to reject or
>> redirect requests that have the wrong 'host' parameter...
>
> And exactly how might that be done, O Great One?
>
Read the apache documentation for how apache does virtual servers.

It selects the website based not on IP address but on HOST type commands.

So for apache you create the default site, BUT it simply says 'you must 
have got it wrong'  because all your VALID sites are in fact 'virtual' ones.

I've got half a dozen sites sharing the same IP address. The default 
site is an 'I don't care' one where I stuff photo albums for a quick way 
to share pictures with friends. If you go in with host: unset, that's 
where you end up.






-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#7771

Am 11.12.2012 11:53, schrieb Tony Marston:
> I always understood than when activated through a web browser that
> $_SERVER['SERVER_NAME'] and $_SERVER['HTTP_HOST'] identified the domain name under
> which the script was being run, but I have come across some instances where both
> SERVER_NAME and HTTP_HOST appear to be spoofed, and I wondered if this is legitimate
> or not.
> 
> I have an application which exists on a live server and a test server, with a
> different database for each, and they both share a common config file which
> identifies which server it is running on so that it can use the relevant database
> credentials. If the server name does not match either of the live or test domain
> names (such as mydomain.com and test.mydomain.com) then it uses invalid credentials
> which causes an error when attempting to access the database. I never though that
> this error would ever appear, but lately I have been getting errors such as the
> following:
> 
> Fatal Error: mysqli_connect(): Access denied for user 'default'@'localhost' (using
> password: YES).
> Error in line 259 of file
> '/var/www/vhosts/mydomain.com/httpdocs/transix/includes/dml.mysqli.class.inc'.
> PHP_SELF: /index.php
> CURRENT DIRECTORY: /var/www/vhosts/mydomain.com/httpdocs
> SERVER_ADDR: nnn.nnn.nnn.nnn
> SERVER_NAME: www.yahoo.com
> HTTP_HOST: www.yahoo.com
> REMOTE_ADDR: 109.108.142.236
> REQUEST_URI: http://www.yahoo.com/
> 
> In order to run this script on my live server the URL should have been
> www.mydomain.com but here you can see it reported as www.yahoo.com. How is this
> possible?

I can think of several ways:

The client did not use HTTP/1.1 = client request without a hostname

Something like apache mod_rewrite on the server is doing it

any other misconfiguration on the server sites (hopefully temporary)

/Str.

[toc] | [prev] | [next] | [standalone]

#7788

"M. Strobel"  wrote in message news:aip563Ft79lU1@mid.uni-berlin.de...
>
>Am 11.12.2012 11:53, schrieb Tony Marston:
>> I always understood than when activated through a web browser that
>> $_SERVER['SERVER_NAME'] and $_SERVER['HTTP_HOST'] identified the domain 
>> name under
>> which the script was being run, but I have come across some instances 
>> where both
>> SERVER_NAME and HTTP_HOST appear to be spoofed, and I wondered if this is 
>> legitimate
>> or not.
>>
>> I have an application which exists on a live server and a test server, 
>> with a
>> different database for each, and they both share a common config file 
>> which
>> identifies which server it is running on so that it can use the relevant 
>> database
>> credentials. If the server name does not match either of the live or test 
>> domain
>> names (such as mydomain.com and test.mydomain.com) then it uses invalid 
>> credentials
>> which causes an error when attempting to access the database. I never 
>> though that
>> this error would ever appear, but lately I have been getting errors such 
>> as the
>> following:
>>
>> Fatal Error: mysqli_connect(): Access denied for user 
>> 'default'@'localhost' (using
>> password: YES).
>> Error in line 259 of file
>> '/var/www/vhosts/mydomain.com/httpdocs/transix/includes/dml.mysqli.class.inc'.
>> PHP_SELF: /index.php
>> CURRENT DIRECTORY: /var/www/vhosts/mydomain.com/httpdocs
>> SERVER_ADDR: nnn.nnn.nnn.nnn
>> SERVER_NAME: www.yahoo.com
>> HTTP_HOST: www.yahoo.com
>> REMOTE_ADDR: 109.108.142.236
>> REQUEST_URI: http://www.yahoo.com/
>>
>> In order to run this script on my live server the URL should have been
>> www.mydomain.com but here you can see it reported as www.yahoo.com. How 
>> is this
>> possible?
>
>I can think of several ways:
>
>The client did not use HTTP/1.1 = client request without a hostname
>
>Something like apache mod_rewrite on the server is doing it
>
>any other misconfiguration on the server sites (hopefully temporary)
>
>/Str.

There are no mod_rewrite settings on the server or any other settings which 
would cause an error as the site has been is use for some while without 
incident, but I am occasionally seeing errors like this because my script 
cannot recognise the value in SERVER_NAME. Somebody is trying to access my 
site, but somehow they are able to force the value of SERVER_NAME to be 
something other than the domain name.

-- 
Tony Marston

http://www.tonymarston.net
http://www.radicore.org 

[toc] | [prev] | [next] | [standalone]

#7785

Tony Marston wrote:
> In order to run this script on my live server the URL should have been
> www.mydomain.com but here you can see it reported as www.yahoo.com. How
> is this possible?

See <http://shiflett.org/blog/2006/mar/server-name-versus-http-host> for
a possible explanation.

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#7786

"Christoph Becker"  wrote in message news:ka9s9b$ul4$1@speranza.aioe.org...
>
>Tony Marston wrote:
>> In order to run this script on my live server the URL should have been
>> www.mydomain.com but here you can see it reported as www.yahoo.com. How
>> is this possible?
>
>See <http://shiflett.org/blog/2006/mar/server-name-versus-http-host> for
>a possible explanation.
>

So according to that document it *IS* possible to visit a web site and cause 
the value of $_SERVER['SERVER_NAME'] to be something other than what was 
typed into the URL. How strange.

-- 
Tony Marston

http://www.tonymarston.net
http://www.radicore.org 

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web