What's the rationale behind the online ban on empty headers in Apache?-PHP Chinese Network Q&A

Article Topic Learning Download Q&A Programming Dictionary Game Recent Updates

简体中文(ZH-CN) English(EN) 繁体中文(ZH-TW) 日本語(JA) 한국어(KO) Melayu(MS) Français(FR) Deutsch(DE)

What's the rationale behind the online ban on empty headers in Apache?

天蓬老师 2017-05-16 16:59:57

671

Today my server was maliciously parsed by a domain name. I checked and found that it was redirected by 301. I checked online and found that closing the empty host header can be used to prevent malicious domain name parsing. Add the following to httpd-vhost.conf Code

NameVirtualHost *  DocumentRoot "E:/error" ServerName abc.com

This method did solve my problem, but I don’t quite understand the principle here....

天蓬老师

欢迎选择我的课程，让我们一起见证您的进步~~

reply all (2)

滿天的星座2017-05-16 17:01:57 2 floor

I know nginx is set up like this, and the principle of Apache should be similar:

server { listen 80 default; server_name _; return 444; }

If nginx does not find the matching domain name in server{} and it is maliciously parsed,_这个默认的server_name，直接返回444自定义状态码，也就是主动关闭请求。也可以使用499will be used. This is another custom status code of nginx, which means that the client cannot wait for the server to respond and actively closes the connection.