11

Apache mod_rewrite: explain me %{HTTP_HOST} expecially when using addon domains

Situation (directories tree) on an Apache server with addon domains:

main-domain.com/ 
| 
|_ .htaccess (just an empty file, no rule in here) 
|_ index.html (shown when accessing http://main-domain.com)
| 
|_ addon-domain-1.com/ 
|  | 
|  |_ .htaccess 
|  |_ index.html (shown when accessing http://addon-domain-1.com or http://main-domain.com/addon-domain-1.com/)
| 
|_ addon-domain-2.com/ 
   | 
   |_ .htaccess 
   |_ index.html (shown when accessing http://addon-domain-2.com or http://main-domain.com/addon-domain-2.com/)

Let's say in "addon-domain-1.com/.htaccess" file I have some rule using %{HTTP_HOST} like:

RewriteCond %{HTTP_HOST} ^something$

Does %{HTTP_HOST} evaluates to the domain of the currently requested url on server???

So if asking for:

http://addon-domain-1.com/

%{HTTP_HOST} will be "addon-domain-1.com"?

http://addon-domain-1.com (without final slash)

%{HTTP_HOST} will still be "addon-domain-1.com"?

http://www.addon-domain-1.com

%{HTTP_HOST} will still be "www.addon-domain-1.com"?

And when asking for:

http://main-domain.com/addon-domain-1.com

%{HTTP_HOST} will be "main-domain.com"???
or "main-domain.com/addon-domain-1.com"???
Cœur
  • 37,241
  • 25
  • 195
  • 267
Marco Demaio
  • 33,578
  • 33
  • 128
  • 159

2 Answers2

6

%{HTTP_*} evaluates to the HTTP header with the name given after the prefix shown. In HTTP 1.1, the host being accessed is given in the Host header, so yes.

Ignacio Vazquez-Abrams
  • 776,304
  • 153
  • 1,341
  • 1,358
  • And this means, that the client sends the contents of the variable. You can not trust anything from the client. And you should not use untrusted data in a rewrite rule. – ceving Jan 11 '19 at 09:50
5

You pretty much guessed them all right! The last one would be;

main-domain.com
TheDeadMedic
  • 9,948
  • 2
  • 35
  • 50