8 ms·
I've learned that there is another fix - use name-based virtual hosting so that your webserver won't accept bogus host names as pointing to your application.
by Andys 18y ago
I've learned that there is another fix - use name-based virtual hosting so that your webserver won't accept bogus host names as pointing to your application.
- jrockway 18y agoYeah, and this is the main reason nobody has noticed (or cared) about this. Since your app isn't dispatched to unless "Host" makes sense, it doesn't really matter. (Does anyone not use name-based virtual hosting?)
- aristus 18y agoIt is definitely an issue. I agree that many sites are not vulnerable, but too many are by default, including many popular web frameworks, and many, many, many hosts that are on dedicated IP addresses and configured to answer to any host.
- pmjordan 18y agoUsing a HTTP 301 response to redirect to the correct hostname may also help with your google rank.