Hostname route ignore HTTP_HOST and give SERVER_NAME precedence

[mbn18]

Web servers that are configured to accept more then one name for a virtual host, pass the following variables:

SERVER_NAME - the virtual host primary name

• In Apache -> ServerName domain.com (other names under ServerAlias )
• In Nginx, the first value of: server_name will-be-servername.com will-not-be-servername.com

HTTP_HOST - the requested domain in the URL

As discussed with @DASPRiD, HTTP_HOST need to be checked first to verify what domain was asked by the client.

@weierophinney raised concern about the host header being spoofed. The Q is, even if so, do we have an alternative?

Extra info about the subject:
http://shiflett.org/blog/2006/mar/server-name-versus-http-host

[DASPRiD]

To clear the "problem" about spoofing:

The general problem is, that HTTP_HOST can contain any value the user supplies (it's simply not trust-able). This is not a real problem here though, since we have two things we know:

• There's usually a VirtualHost (different webservers, same concept) backing the application. This one usually only allows a fixed list of domain names. When HTTP_HOST is spoofed, the VirtualHost will simply not match, so no problem there.
• In case we get a spoofed HTTP_HOST into the application, we are still fine. For routing, the HTTP_HOST is only used for matching. If the HTTP_HOST matches no (existing) hostname route, the user will simply get a 404 response.

The only problem we have is if the developer uses the request object to output the HTTP_HOST in a view or so, and it is spoofed with JavaScript code or such. But that is usual output escaping. I would only suggest one thing, to make sure we don't let any invalid HTTP_HOST through:

Within the Zend\Http\PhpEnvironment\Request, when finding an HTTP_HOST header, we should verify that it is valid, using Zend\Validator\Hostname. The only question would be, if we should either throw an exception when it is invalid, or just ignore the value in that case. Personally I tend to throw an exception, as we should terminate any possible attack as early as possible.

@weierophinney: Any thoughts about it?

[DASPRiD]

@mbn18 I talked with @weierophinney about this at DPC. The way I suggested would be fine to him (including the validation). Would you be able to to this until Monday or Tuesday?

[mbn18]

@DASPRiD Yes, will spare some time tomorrow. But first will try to catch you on the IRC

[mbn18]

Ok, I added a hostname validator and splited the elseif from its chain.
If the validation fail, the next (new) if kick in and set the SERVER_NAME.

Also added a malformed test

[weierophinney]

add spaces around the => operator.

[weierophinney]

All feedback I provided was incorporated during merge.