10
It happen that Googlebot discovers the alternate URL. The official way if you want your application to be accessible through all those URLs for internal purposes, is to use canonical links as you suggest.
The other way is to simply issue 301 Permanent Redirect so that all traffic uses the official URLs. This will also allow you to enforce the use of HTTPS ...
3
those pages/URLs should NOT be indexed
Well, they should be indexed, but not at the other hostnames.
You should certainly implement OPTION#1 and configure a rel="canonical" element. This should also protect you against non-canonical query strings (intentional or malicious).
AND, ideally, you would 301 redirect any requests for non-canonical ...
1
I would recommend using robots.txt to disallow the URLs as you suggest. This will keep Googlebot from crawling all your products URLs with a query string.
Disallow: /products?
From the example query string you gave, it appears that there could be a very large number of possible query strings from various combinations:
/products?brands=X,Y&size=1,2
/...
Only top voted, non community-wiki answers of a minimum length are eligible
