From my own answer, I had to replace
$http_host to get my problem resolved...
But is this safe?
It seems like all
$http_host is doing is to exposed the whole
HOST from header.
The explanation here is still not clear to me...
Someone has any idea why would
$http_host be more dangerous?
Actually, this is my 3rd edit... I should reconsider my position on this after reading this: http://stackoverflow.com/questions/1459739/php-serverhttp-host-vs-serverserver-name-am-i-understanding-the-ma
I am not sure how nginx reacts to that, but do you guys think nginx would also inline with Chris's test result that neither is safe?
Under what circumstances, can you think of a way to exploit when using $http_host? Furthermore, why is it important to strip out the port number?
I understand that it is possible to comprised the network, and send in some
Host: fake or old ip and then do rebind attack as I read somewhere else?