I've setup a default server for my nginx, that should respond to all IP based requests, as well to all faked and whatever ones. This works, well almost always.
Requesting a the site like the following serves the site from my application, instead of the default server:
http https://my-app.com 'Host:my-app.com:email@example.com'
Requesting it like this:
http https://my-app.com 'Host:myyy-app.com:firstname.lastname@example.org'
The default site is served.
My app has a normal server_name line, like this:
How can this be configured correctly? Or is this a limitation in nginx? Or my bad? The @ in hosts is normally used when specifying basic auth, right?
More info: my Django application, receiving the request, complains that the header is not valid according to RFC 1034/1035. So maybe nginx should drop the request right away?
Even more info: This behaviour was found during a security test. So it has nothing to do with a real world thing...