{"action":"created","issue":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/13050","repository_url":"https://api.github.com/repos/yiisoft/yii2","labels_url":"https://api.github.com/repos/yiisoft/yii2/issues/13050/labels{/name}","comments_url":"https://api.github.com/repos/yiisoft/yii2/issues/13050/comments","events_url":"https://api.github.com/repos/yiisoft/yii2/issues/13050/events","html_url":"https://github.com/yiisoft/yii2/issues/13050","id":190496060,"number":13050,"title":"host header attack problem ","user":{"login":"sepidemahmoodi","id":16792374,"avatar_url":"https://avatars.githubusercontent.com/u/16792374?v=3","gravatar_id":"","url":"https://api.github.com/users/sepidemahmoodi","html_url":"https://github.com/sepidemahmoodi","followers_url":"https://api.github.com/users/sepidemahmoodi/followers","following_url":"https://api.github.com/users/sepidemahmoodi/following{/other_user}","gists_url":"https://api.github.com/users/sepidemahmoodi/gists{/gist_id}","starred_url":"https://api.github.com/users/sepidemahmoodi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sepidemahmoodi/subscriptions","organizations_url":"https://api.github.com/users/sepidemahmoodi/orgs","repos_url":"https://api.github.com/users/sepidemahmoodi/repos","events_url":"https://api.github.com/users/sepidemahmoodi/events{/privacy}","received_events_url":"https://api.github.com/users/sepidemahmoodi/received_events","type":"User","site_admin":false},"labels":[{"id":55267601,"url":"https://api.github.com/repos/yiisoft/yii2/labels/severty:security","name":"severty:security","color":"5319e7","default":false},{"id":33330247,"url":"https://api.github.com/repos/yiisoft/yii2/labels/status:ready%20for%20adoption","name":"status:ready for adoption","color":"02e10c","default":false},{"id":33208865,"url":"https://api.github.com/repos/yiisoft/yii2/labels/type:docs","name":"type:docs","color":"207de5","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/yiisoft/yii2/milestones/9","html_url":"https://github.com/yiisoft/yii2/milestones/2.0.x","labels_url":"https://api.github.com/repos/yiisoft/yii2/milestones/9/labels","id":831720,"number":9,"title":"2.0.x","description":"","creator":{"login":"cebe","id":189796,"avatar_url":"https://avatars.githubusercontent.com/u/189796?v=3","gravatar_id":"","url":"https://api.github.com/users/cebe","html_url":"https://github.com/cebe","followers_url":"https://api.github.com/users/cebe/followers","following_url":"https://api.github.com/users/cebe/following{/other_user}","gists_url":"https://api.github.com/users/cebe/gists{/gist_id}","starred_url":"https://api.github.com/users/cebe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cebe/subscriptions","organizations_url":"https://api.github.com/users/cebe/orgs","repos_url":"https://api.github.com/users/cebe/repos","events_url":"https://api.github.com/users/cebe/events{/privacy}","received_events_url":"https://api.github.com/users/cebe/received_events","type":"User","site_admin":false},"open_issues":306,"closed_issues":1,"state":"open","created_at":"2014-10-19T13:49:45Z","updated_at":"2016-11-22T13:28:01Z","due_on":null,"closed_at":null},"comments":29,"created_at":"2016-11-19T13:18:43Z","updated_at":"2016-11-22T13:37:30Z","closed_at":null,"body":"Hi,\r\nI cache some menu links in my application (datacaching using filecache), sometimes hostname part of these links change to a random website (usually chinese websites) and I have to flush the cache to make it work again.\r\nafter some research and studying webserver logs it turned out to be \"Host Header Attack\". turning off caching would solve the problem but that's not the solution for me as I have very high traffic websites. reading some articles ( https://www.acunetix.com/vulnerabilities/web/host-header-attack ) suggest not using `$_SERVER['HTTP_HOST']` when creating links and using `$_SERVER['SERVER_NAME']` instead. I tried to simulate the situation using burp suite application and the suggested solution acutally works. but the code responsible for getting host info is located in core framework and is in `\\yii\\web\\Request::getHostInfo` method and the above change should be applied on that method.\r\nalthough I don't know if it has any other side effect rather than ruined links when caching is enabled.\r\n"},"comment":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/comments/262242199","html_url":"https://github.com/yiisoft/yii2/issues/13050#issuecomment-262242199","issue_url":"https://api.github.com/repos/yiisoft/yii2/issues/13050","id":262242199,"user":{"login":"tom--","id":1178722,"avatar_url":"https://avatars.githubusercontent.com/u/1178722?v=3","gravatar_id":"","url":"https://api.github.com/users/tom--","html_url":"https://github.com/tom--","followers_url":"https://api.github.com/users/tom--/followers","following_url":"https://api.github.com/users/tom--/following{/other_user}","gists_url":"https://api.github.com/users/tom--/gists{/gist_id}","starred_url":"https://api.github.com/users/tom--/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tom--/subscriptions","organizations_url":"https://api.github.com/users/tom--/orgs","repos_url":"https://api.github.com/users/tom--/repos","events_url":"https://api.github.com/users/tom--/events{/privacy}","received_events_url":"https://api.github.com/users/tom--/received_events","type":"User","site_admin":false},"created_at":"2016-11-22T13:37:30Z","updated_at":"2016-11-22T13:37:30Z","body":"I completely agree that we *can* blame server config.\r\n\r\nThis means Yii takes the stance that a the server must enforce the 1:1 mapping of Hose header to vhost to app.\r\n\r\nSo why then does Yii use HTTP_HOST?"}}
{"actor":{"display_login":"tom--"}}