I've setup a default server for my nginx, that should respond to all IP based requests, as well to all faked and whatever ones. This works, well almost always.

Requesting a the site like the following serves the site from my application, instead of the default server:

http https://my-app.com 'Host:my-app.com:443@whateverfake.com'

Requesting it like this:

http https://my-app.com 'Host:myyy-app.com:443@whateverfake.com'

The default site is served.

My app has a normal server_name line, like this:

server_name my-app.com;

How can this be configured correctly? Or is this a limitation in nginx? Or my bad? The @ in hosts is normally used when specifying basic auth, right?

More info: my Django application, receiving the request, complains that the header is not valid according to RFC 1034/1035. So maybe nginx should drop the request right away?

Even more info: This behaviour was found during a security test. So it has nothing to do with a real world thing...

  • No. Authentication is not passed in the http Host header (according to RFC7230§5.4). You are passing an illegal header value to Nginx. Perhaps Nginx should respond with a 400 status, but that would be a matter for the developers. – Richard Smith May 24 at 10:14
  • so, only because it starts with the correct hostname, the request is passed to the non default server? this really is strange, and in my oppionion should not be the case...thanks anyway - I will add somth. like this, probably: docs.hardentheworld.org/Applications/Nginx/… – benzkji May 24 at 10:18
  • so the answer would be: you are nothing doing wrong, this is by design of nginx, and you'll have to protect yourself against it... – benzkji May 24 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.