Host and Authority

## What Host is `Host` is a request header whose value is the *authority* component of the URL the client is trying to reach: a hostname, optionally followed by a colon and a port when the port is not the default for the scheme. For `https://shop.example.com/cart` the client sends `Host: shop.example.com`. For `http://api.example.com:8080/v1/ping` it sends `Host: api.example.com:8080`. ## Why it had to be invented An HTTP/1.0 request line looks like `GET /index.html HTTP/1.0`. It contains a path and nothing else. The only thing that told the server which site was wanted was the TCP connection itself — the destination IP address and port. That worked while every website had its own IP address. It stopped working as the web grew. IPv4 addresses are scarce and expensive, and hosting providers wanted to put hundreds of sites on one machine behind one address. A server receiving `GET /index.html` on port 80 has no way to know whether the visitor typed `alice.example.com` or `bob.example.com`; both resolve to the same address, and both produce a byte-identical request. HTTP/1.1 solved this by requiring the client to state the hostname explicitly. The specification wording (RFC 9110/9112, previously RFC 2616) is that a client **MUST** send a `Host` header field in every HTTP/1.1 request message, and it must be sent before the message body. ## Name-based virtual hosting Once Host exists, one listening socket can serve many sites. The server keeps a table of hostnames to configurations and dispatches on the Host value: - **nginx** matches `server_name` inside `server` blocks; a request whose Host matches nothing falls through to the *default server* for that listen address. - **Apache httpd** matches `ServerName`/`ServerAlias` inside `VirtualHost`; unmatched requests go to the first defined vhost. - **Kubernetes ingress controllers, API gateways, and CDNs** all express routing rules as host plus path. The alternative, *IP-based virtual hosting*, gives each site its own address and needs no Host header — it is still occasionally used but wastes addresses. ## The error rules: missing, duplicate, invalid The spec is unusually blunt here. A server **must** respond with `400 Bad Request` when an HTTP/1.1 request: - contains no `Host` field, - contains more than one `Host` field, or - contains a `Host` field with an invalid field value (bad syntax, disallowed characters). The motivation is security, not pedantry. If a request carries two Host headers, every component in the chain has to guess which one counts. A CDN might route on the first and an origin cache might key on the second, so an attacker can make the cache store a response for host A under a key for host B — classic cache poisoning — or split a request across a proxy boundary (request smuggling). Making duplicates a hard error removes the guess. ## Request-target forms and how Host interacts Most requests use *origin-form*: `GET /cart HTTP/1.1` plus a Host header. Two other forms exist: - **absolute-form** — `GET http://example.com/cart HTTP/1.1` — used by clients talking to a forward proxy. Host must still be present for compatibility, but the authority inside the request line wins; the server ignores Host. - **authority-form** — `CONNECT example.com:443 HTTP/1.1` — used to establish a tunnel; the authority is the request target itself. ## What replaced it in HTTP/2 and HTTP/3 HTTP/2 and HTTP/3 do not use a Host header as the primary carrier. They use the `:authority` pseudo-header field. A client may also send Host, but if both appear they must agree; an intermediary translating HTTP/2 down to HTTP/1.1 generates the Host header from `:authority`. Conceptually nothing changed — the authority is still mandatory metadata — only the encoding did. ## Practical consequences you will hit - Testing a vhost before DNS is switched: `curl -H 'Host: shop.example.com' http://1.2.3.4/` or, so TLS also works, `curl --resolve shop.example.com:443:1.2.3.4`. - Load-balancer health checks that dial the IP directly send `Host: 1.2.3.4`, match no vhost, and land on the default server — a frequent cause of "the LB says the pod is unhealthy but curl from my laptop works". - Anything that generates absolute links from the request Host inherits whatever the client sent, which is an injection vector unless the accepted hostnames are constrained.