HTTP: The Definitive Guide says

An origin server that isn’t virtually hosted, and doesn’t allow resources to differ by the requested host, may ignore the Host header field value. But any origin server that does differentiate resources based on the host must use the following rules for determining the requested resource on an HTTP/1.1 request:

  1. If the URL in the HTTP request message is absolute (i.e., contains a scheme and host component), the value in the Host header is ignored in favor of the URL.

  2. If the URL in the HTTP request message doesn’t have a host, and the request contains a Host header, the value of the host/port is obtained from the Host header.

  3. If no valid host can be determined through Steps 1 or 2, a 400 Bad Response response is returned to the client.

Where is "the URL in the HTTP request message"?

Is it the one in the request line (in the first line in a HTTP request, after method such as GET)?



The URL is not required to appear anywhere in an HTTP request (except when made to a proxy; see below).

Point 2 in the quote from your book has an error. The URL does not appear in the request line in the origin form, the most common form of HTTP request target. Only specific components of a URL normally appear in the request, i.e. the host (and port if applicable) which appears in the Host header, and the path and query string which appear in the request line. One thing that does not appear in the request is the scheme (http or https), which occasionally gives developers fits if the web application actually has a need to know the scheme.

It is possible for an alternate form of the request line to contain the complete URL as the request target, and it is mandatory for servers to be able to process this format, known as the absolute form. This form is not normally seen except when the user agent is knowingly speaking to an HTTP proxy. In this case, the proxy needs to know the scheme so that it can try to pass the request along, and the complete URL form is the way to do that defined in the relevant standard (RFC 7230).

  • Thanks. Does " the URL in the HTTP request message " in the quote mean the URL in the request line? – Tim Feb 13 '19 at 14:14
  • @Tim Your book is sloppy and has gotten some things wrong. In the normal case, it is not the URL that appears in the request line, but only the path component (and query string, if the URL has one). So point 2 says URL when it should not. In point 1, the "absolute" URL is actually a URL. – Michael Hampton Feb 13 '19 at 14:18
  • Is it true that " One thing that does not appear in the request is the scheme (http or https)"? In the request line, there is always HTTP/1.0 or something else – Tim Feb 13 '19 at 15:04
  • @Tim This does not tell whether HTTP or HTTPS was used. – Michael Hampton Feb 13 '19 at 15:05
  • 2
    Did you not read the RFC yet? – Michael Hampton Feb 13 '19 at 15:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.