Is $http_host dangerous?

x7311 nginx-forum at nginx.us
Sun May 27 22:16:06 UTC 2012


Actually, I should reconsider my position on this after reading this:
http://stackoverflow.com/questions/1459739/php-serverhttp-host-vs-serverserver-name-am-i-understanding-the-ma

I am not sure how nginx reacts to that, but according to you Francis,
you seems to be inline with Chris Shiflett that neither is safe nor
insecure. They are pretty much the same thing. 

Under one circumstances, can you think of a way to exploit when using
$http_host?

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,226866,226883#msg-226883



More information about the nginx mailing list