Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7793

Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script?

Show all headers | View raw

"The Natural Philosopher"  wrote in message 
news:kaam8e$n67$1@news.albasani.net...
>
>On 12/12/12 18:50, Daniel Pitts wrote:
>> On 12/12/12 9:22 AM, Tony Marston wrote:
>>> "Scott Johnson"  wrote in message news:kaa0on$qjt$1@dont-email.me...
>>>>
>>>> On 12/11/2012 11:25 PM, Tony Marston wrote:
>>>>
>>>>>> You may try phpinfo() to get the full list of data/variables set by
>>>>>> your server.  Some here may ask for that info to help you further.
>>>>>
>>>>> The output from phpinfo() looks perfectly normal and correct. It shows
>>>>> the expected values for SERVER_NAME and HTTP_HOST.
>>>>>
>>>>
>>>> If you are getting the right value in SERVER_NAME and HTTP_HOST using
>>>> phpinfo() but are then getting a different value when you use the same
>>>> variable in your script, then you have an error in your script.
>>>
>>> These is no error in the script as it runs perfectly for thousands of
>>> requests, but occasionally it fails because $_SERVER['SERVER_NAME'] and
>>> $_SERVER['HOST_NAME'] contain values which are different from those
>>> which I expect and which are reported by phpinfo(). It appears that is
>>> *IS* possible for the client to spoof these values, as reported in
>>> http://shiflett.org/blog/2006/mar/server-name-versus-http-host
>>>
>>
>> The way that HTTP works, is that the client connects to the IP address,
>> and then sends the host name it was trying to connect to as part of the
>> headers.  eg. Host: www.example.com.  This allows for many virtual hosts
>> on a single IP/Port.
>>
>> What could happen is that someone's DNS is pointing to your IP, and so
>> you receive a request that was meant for a different URL.
>
>all of which can be overcome by setting up the web server to reject or 
>redirect requests that have the wrong 'host' parameter...

And exactly how might that be done, O Great One?

-- 
Tony Marston

http://www.tonymarston.net
http://www.radicore.org 

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-11 10:53 +0000
  Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Scott Johnson <noonehome@chalupasworld.com> - 2012-12-11 05:28 -0800
    Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Paul Herber <paul@pherber.com> - 2012-12-11 14:01 +0000
      Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-12 13:05 +0000
    Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-12 07:25 +0000
      Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Scott Johnson <noonehome@chalupasworld.com> - 2012-12-12 05:27 -0800
        Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-12 17:22 +0000
          Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2012-12-12 10:50 -0800
            Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? The Natural Philosopher <tnp@invalid.invalid> - 2012-12-12 19:34 +0000
              Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-13 06:52 +0000
                Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Anders Wegge Keller <wegge@wegge.dk> - 2012-12-13 08:02 +0100
                Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? The Natural Philosopher <tnp@invalid.invalid> - 2012-12-13 11:43 +0000
  Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-11 17:26 +0100
    Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-12 13:10 +0000
  Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? Christoph Becker <cmbecker69@gmx.de> - 2012-12-12 13:11 +0100
    Re: When is it possible for $_SERVER['SERVER_NAME'] to contain something other than the URL which actvated the script? "Tony Marston" <TonyMarston@hotmail.com> - 2012-12-12 13:00 +0000

csiph-web