From my own answer, I had to replace $host with $http_host to get my problem resolved...

But is this safe?

It seems like all $http_host is doing is to expose the whole HOST from header. The explanation here is still not clear to me...

Does anyone have any idea why would $http_host be more dangerous?


Actually, this is my 3rd edit... I should reconsider my position on this after reading this: https://stackoverflow.com/questions/1459739/php-serverhttp-host-vs-serverserver-name-am-i-understanding-the-ma

I am not sure how nginx reacts to that, but do you guys think nginx would also inline with Chris's test result that neither is safe?

Under what circumstances, can you think of a way to exploit when using $http_host? Furthermore, why is it important to strip out the port number?

I understand that it is possible to compromise the network, and send in some Host: fake or old ip and then perform a rebind attack as I read somewhere else?


$host is simply $http_host with some processing (stripping port number and lowercasing) and a default value (of the server_name), so there's no less "exposure" to the Host header sent by the client when using $http_host. There's no danger in this though.

  • Thanks. I've updated my question under edit. What do you think? Thanks. – CppLearner May 27 '12 at 21:58

Checking all header values in application is needed. Though nginx can do some protection to your web-app, you should not rely only on it.

I believe it might be possible to write a webapp that is vulnerable to host header abuse through both $host and $http_host, but it isn't a reason to avoid it's usage in nginx config.

  • Thanks. I would like to confirm whether my understanding is correct or not. Please sees my post's update! – CppLearner May 27 '12 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.