Forum OpenACS Development: Re: Untrusted host header

2: Re: Untrusted host header (response to 1)
Posted by Malte Sussdorff on
I stumbled upon this and just in case somebody else needs to figure this out.

For *util_current_location* to find the correct URL and not fall back, make sure to set the "Host" header in NGINX like

proxy_set_header Host $host:443;

3: Re: Untrusted host header (response to 2)
Posted by Gustaf Neumann on
The warning message with "Untrusted host header" comes, when the server receives a content in the "Host:" header field, which is not trusted. The host header field is used for determining the virtual server (one NaviServer instance can serve multiple different virtual servers, see e.g. [1]).

On OpenACS sites, in most cases, there is only one server configured. When the host header field contains a value, which is unknown, it falls back to the default server - which is for OpenACS the right thing. The accepted values are defined per driver in the */servers" section, where a domain name or IP address is mapped to the logical server (see e.g. [2]). In case, an OpenACS instance should be called under different names, these should be added to this section in the configuration file. Note that versions of NaviServer (4.99.16 or newer, see [3]) require less entries there.

When running behind a proxy, it is probably better to add the expected entry to the */servers section, since the host header sent to nginx could as well contain already a port, so the concatenation might be as well a problem.

All the best