I guess the fundamental problem here now that I think about it is that such a Host header based determination relies on trusting the client of what the host should be, which, if you think about it isn't a good programming practice.

For example, if Apache is configured such that it just answers requests regardless of what the Host header says (which is the default configuration usually), then if the client sends "gobbledygook.bleh" as the host name, then that becomes the URL. While this may be harmless, it can at least be a source of confusion and there may be even a security issue lurking there somewhere.

I think a properly designed site should insist on its host name, i.e. "I see you think I'm gobbledygook.bleh, but I'm going to redirect you to http://www.modpython.org/ because that is my true name". This is very common with sites that respond to both www.site.com and site.com, but insist on only one of those by redirecting.

Grisha

Reply via email to