Bug #64457 [Ana->Csd]: HTTP_HOST, SERVER_NAME, SERVER_PORT spoofing

Edit report at https://bugs.php.net/bug.php?id=64457&edit=1 ID: 64457 Updated by: cmb@php.net Reported by: dm@php.net Summary: HTTP_HOST, SERVER_NAME, SERVER_PORT spoofing -Status: Analyzed +Status: Closed Type: Bug Package: Documentation problem Operating System: All PHP Version: Irrelevant -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: This bug has been fixed in the documentation's XML sources. Since the online and downloadable versions of the documentation need some time to get updated, we would like to ask you to be a bit patient. Thank you for the report, and for helping us make our documentation better. Previous Comments: ------------------------------------------------------------------------ [2016-06-20 15:27:18] cmb@php.net Automatic comment from SVN on behalf of cmb Revision: http://svn.php.net/viewvc/?view=revision&revision=339426 Log: Fix #64457: HTTP_HOST, SERVER_NAME, SERVER_PORT spoofing ------------------------------------------------------------------------ [2013-03-22 16:56:34] dm@php.net With the help of thumbs from #httpd, I was directed to: http://httpd.apache.org/docs/current/mod/core.html#usecanonicalphysicalport It was pointed out: http://httpd.apache.org/docs/2.4/mod/core.html#comment_1000 So, PHP is kept in the dark if these directives are Off. On our side, docs should be updated to advise that values are not be trusted if aforementioned directives are Off. ------------------------------------------------------------------------ [2013-03-19 20:58:07] rasmus@php.net I have no idea why it is filling in the wrong SERVER_PORT, but it is. This doesn't come from PHP and it isn't PHP's job to second-guess what the web server is telling us here. Try to reproduce it with a straight CGI script without any PHP involvement. ------------------------------------------------------------------------ [2013-03-19 19:38:43] dm@php.net Indeed, it's not a PHP issue per se, and I'm glad, thank you. I'm aware that $_SERVER['HTTP_*'] are passed on, but what about $_SERVER['SERVER_*'] (or you meant everything web server related)? Why would Apache not know what is the hostname and which port is it serving through? Nginx and some variations of Apache (haven't tried sending HTTP 1.0 request) settings don't have this "problem". RFC 2616 states that 1.1 requests specifying a hostname not in use by the server should receive a 400 Bad Request response, which is sometimes (I don't know when exactly) is not the case. Thanks. ------------------------------------------------------------------------ [2013-03-19 19:16:48] rasmus@php.net But how is this a PHP issue? PHP doesn't set the $_SERVER['HTTP_*"] variables at all. They are inherited directly from the web server and are the same variables that the web server would set for CGI scripts that might get executed. So while we could try to do some analysis and filtering at the PHP level, anything else the web server invokes would still be getting the spoofed port. The fix should be at the web server level. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=64457 -- Edit this bug report at https://bugs.php.net/bug.php?id=64457&edit=1