3

I have a single instance of nginx serving several virtual hosts with their respective domains on the same ip address. When someone tries to access my ip, they are served one of them, but since my server redirects all requests to https, those client fail. What virtual host should I serve instead? Should I use rewrite to force a specific domain?

  • Do you think it would be appropriate to serve a particular site for such requests? Why not reject them? A request without a Host: header is likely to be a (waste of time) bot anyway. I would probably configure a default virtual host that these requests get routed to. – DocRoot Dec 16 '16 at 21:55
  • @DocRoot I'm not sure what would be the sane behavior here, that's why I don't reject them, but considering RFC2616, I think 400 might be expected enough. – Braiam Dec 16 '16 at 21:59
  • Yes, a 400 seems reasonable (that's what I meant by rejecting - rather than literally dropping the request or leaving it hanging). On a "shared server" it's impossible to route an IP (or missing Host header) request in any meaningful way, unless you had a specific requirement to do so. Most shared servers I've seen just return an error-like page (default virtual host) but with a 200 OK status (not saying that is strictly correct). Some shared hosts just return the first (customers) virtual host - which is quite bad really. – DocRoot Dec 16 '16 at 22:25
2

Considering RFC-7230, you might just return 400 for such request:

A server MUST respond with a 400 (Bad Request) status code to any HTTP/1.1 request message that lacks a Host header field and to any request message that contains more than one Host header field or a Host header field with an invalid field-value.

Unless you have a good reason to redirect them to a specific domain.

  • Nginx is a special case since it supports a 444 (no response) code and drops the connection. This is probably what you want since it provides better security against Host header attacks. Related answer here. – Tom Brossman Dec 17 '16 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.