{"thread":{"id":"15313","subject":"[cgit PATCH] use Host: header to generate cgit_hosturl","startedAt":"2008-09-01T06:30:33Z","lastAt":"2008-09-02T07:24:26Z","messageCount":6,"participants":["Eric Wong","Lars Hjemli"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"89367","messageId":"20080901063033.GA21848@untitled","threadId":"15313","inReplyTo":null,"subject":"[cgit PATCH] use Host: header to generate cgit_hosturl","fromName":"Eric Wong","fromEmail":"normalperson@yhbt.net","sentAt":"2008-09-01T06:30:33Z","receivedAt":"2008-09-01T06:30:33Z","isPatch":true,"sender":{"key":"e@80x24.org","avatar":null},"body":"I run an instance of lighttpd for cgit behind nginx (nginx\ndoesn't execute CGI). So the port (SERVER_PORT=33333) that\nlighttpd runs on sends to cgit is different from the standard\nport 80 that public clients connect to (via nginx).\n\nThis was causing the Atom feed URL to show the private port\nnumber that lighttpd was running on.\n\nSince the HTTP/1.1 \"Host\" header includes the port number if\nrunning on a non-standard port, it allows non-client-facing HTTP\nservers to transparently generate public URLs that clients can\nsee.\n\nSo use the \"Host\" header if it is available and fall back to\nSERVER_NAME/SERVER_PORT for some clients that don't set\nHTTP_HOST.\n\nSigned-off-by: Eric Wong \n---\n ui-shared.c | 19 ++++++++++++-------\n 1 files changed, 12 insertions(+), 7 deletions(-)\n\ndiff --git a/ui-shared.c b/ui-shared.c\nindex 37c60b2..5a848c1 100644\n--- a/ui-shared.c\n+++ b/ui-shared.c\n@@ -38,14 +38,19 @@ char *cgit_hosturl()\n {\n \tchar *host, *port;\n \n-\thost = getenv(\"SERVER_NAME\");\n-\tif (!host)\n-\t\treturn NULL;\n-\tport = getenv(\"SERVER_PORT\");\n-\tif (port && atoi(port) != 80)\n-\t\thost = xstrdup(fmt(\"%s:%d\", host, atoi(port)));\n-\telse\n+\thost = getenv(\"HTTP_HOST\");\n+\tif (host) {\n \t\thost = xstrdup(host);\n+\t} else {\n+\t\thost = getenv(\"SERVER_NAME\");\n+\t\tif (!host)\n+\t\t\treturn NULL;\n+\t\tport = getenv(\"SERVER_PORT\");\n+\t\tif (port && atoi(port) != 80)\n+\t\t\thost = xstrdup(fmt(\"%s:%d\", host, atoi(port)));\n+\t\telse\n+\t\t\thost = xstrdup(host);\n+\t}\n \treturn host;\n }\n \n-- \nEric Wong\n"},{"id":"89440","messageId":"8c5c35580809011336v58b139acu5078cafd3440c786@mail.gmail.com","threadId":"15313","inReplyTo":"20080901063033.GA21848@untitled","subject":"Re: [cgit PATCH] use Host: header to generate cgit_hosturl","fromName":"Lars Hjemli","fromEmail":"hjemli@gmail.com","sentAt":"2008-09-01T20:36:49Z","receivedAt":"2008-09-01T20:36:49Z","isPatch":true,"sender":{"key":"hjemli@gmail.com","avatar":null},"body":"On Mon, Sep 1, 2008 at 8:30 AM, Eric Wong wrote:\n> I run an instance of lighttpd for cgit behind nginx (nginx\n> doesn't execute CGI). So the port (SERVER_PORT=33333) that\n> lighttpd runs on sends to cgit is different from the standard\n> port 80 that public clients connect to (via nginx).\n>\n> This was causing the Atom feed URL to show the private port\n> number that lighttpd was running on.\n>\n> Since the HTTP/1.1 \"Host\" header includes the port number if\n> running on a non-standard port, it allows non-client-facing HTTP\n> servers to transparently generate public URLs that clients can\n> see.\n\nThis makes a lot of sense, thanks for the detailed description.\n\n\n> So use the \"Host\" header if it is available and fall back to\n> SERVER_NAME/SERVER_PORT for some clients that don't set\n> HTTP_HOST.\n\nMaybe it would be better to use a new cgitrc parameter as fallback if\nthe client doesn't provide the \"Host\" header?\n\n--\nlarsh\n"},{"id":"89457","messageId":"20080901230741.GA19984@hand.yhbt.net","threadId":"15313","inReplyTo":"8c5c35580809011336v58b139acu5078cafd3440c786@mail.gmail.com","subject":"Re: [cgit PATCH] use Host: header to generate cgit_hosturl","fromName":"Eric Wong","fromEmail":"normalperson@yhbt.net","sentAt":"2008-09-01T23:07:42Z","receivedAt":"2008-09-01T23:07:42Z","isPatch":true,"sender":{"key":"e@80x24.org","avatar":null},"body":"Lars Hjemli wrote:\n> On Mon, Sep 1, 2008 at 8:30 AM, Eric Wong wrote:\n> > So use the \"Host\" header if it is available and fall back to\n> > SERVER_NAME/SERVER_PORT for some clients that don't set\n> > HTTP_HOST.\n> \n> Maybe it would be better to use a new cgitrc parameter as fallback if\n> the client doesn't provide the \"Host\" header?\n\nThat sounds a bit hackish to me since HTTP_HOST, SERVER_NAME and\nSERVER_PORT are all standardized. Anyhow, it's your call :)\n\n-- \nEric Wong\n"},{"id":"89459","messageId":"8c5c35580809011614k6ec5a0e9tdfd5d3031c58b84@mail.gmail.com","threadId":"15313","inReplyTo":"20080901230741.GA19984@hand.yhbt.net","subject":"Re: [cgit PATCH] use Host: header to generate cgit_hosturl","fromName":"Lars Hjemli","fromEmail":"hjemli@gmail.com","sentAt":"2008-09-01T23:14:31Z","receivedAt":"2008-09-01T23:14:31Z","isPatch":true,"sender":{"key":"hjemli@gmail.com","avatar":null},"body":"On Tue, Sep 2, 2008 at 1:07 AM, Eric Wong wrote:\n> Lars Hjemli wrote:\n>> On Mon, Sep 1, 2008 at 8:30 AM, Eric Wong wrote:\n>> > So use the \"Host\" header if it is available and fall back to\n>> > SERVER_NAME/SERVER_PORT for some clients that don't set\n>> > HTTP_HOST.\n>>\n>> Maybe it would be better to use a new cgitrc parameter as fallback if\n>> the client doesn't provide the \"Host\" header?\n>\n> That sounds a bit hackish to me since HTTP_HOST, SERVER_NAME and\n> SERVER_PORT are all standardized. Anyhow, it's your call :)\n\nI just figured that since SERVER_NAME/SERVER_PORT doesn't work in a\nsetup like the one you described, clients which doesn't provide the\n\"Host\" header would never get a correct url. A default value for the\n\"Host\" header in cgitrc would work around this issue.\n\n--\nlarsh\n"},{"id":"89462","messageId":"20080901233033.GB19984@hand.yhbt.net","threadId":"15313","inReplyTo":"8c5c35580809011614k6ec5a0e9tdfd5d3031c58b84@mail.gmail.com","subject":"Re: [cgit PATCH] use Host: header to generate cgit_hosturl","fromName":"Eric Wong","fromEmail":"normalperson@yhbt.net","sentAt":"2008-09-01T23:30:33Z","receivedAt":"2008-09-01T23:30:33Z","isPatch":true,"sender":{"key":"e@80x24.org","avatar":null},"body":"Lars Hjemli wrote:\n> On Tue, Sep 2, 2008 at 1:07 AM, Eric Wong wrote:\n> > Lars Hjemli wrote:\n> >> On Mon, Sep 1, 2008 at 8:30 AM, Eric Wong wrote:\n> >> > So use the \"Host\" header if it is available and fall back to\n> >> > SERVER_NAME/SERVER_PORT for some clients that don't set\n> >> > HTTP_HOST.\n> >>\n> >> Maybe it would be better to use a new cgitrc parameter as fallback if\n> >> the client doesn't provide the \"Host\" header?\n> >\n> > That sounds a bit hackish to me since HTTP_HOST, SERVER_NAME and\n> > SERVER_PORT are all standardized. Anyhow, it's your call :)\n> \n> I just figured that since SERVER_NAME/SERVER_PORT doesn't work in a\n> setup like the one you described, clients which doesn't provide the\n> \"Host\" header would never get a correct url. A default value for the\n> \"Host\" header in cgitrc would work around this issue.\n\nActually, in my situation, the proxy server will unconditionally set a\nHost: header before sending the request to the lighttpd backend. Header\nrewriting/injection is a common feature in HTTP aware proxies.\n\n-- \nEric Wong\n"},{"id":"89489","messageId":"8c5c35580809020024x564e8bc3o410cea6d4cd905@mail.gmail.com","threadId":"15313","inReplyTo":"20080901233033.GB19984@hand.yhbt.net","subject":"Re: [cgit PATCH] use Host: header to generate cgit_hosturl","fromName":"Lars Hjemli","fromEmail":"hjemli@gmail.com","sentAt":"2008-09-02T07:24:26Z","receivedAt":"2008-09-02T07:24:26Z","isPatch":true,"sender":{"key":"hjemli@gmail.com","avatar":null},"body":"On Tue, Sep 2, 2008 at 1:30 AM, Eric Wong wrote:\n> Lars Hjemli wrote:\n>> On Tue, Sep 2, 2008 at 1:07 AM, Eric Wong wrote:\n>> > Lars Hjemli wrote:\n>> >> On Mon, Sep 1, 2008 at 8:30 AM, Eric Wong wrote:\n>> >> > So use the \"Host\" header if it is available and fall back to\n>> >> > SERVER_NAME/SERVER_PORT for some clients that don't set\n>> >> > HTTP_HOST.\n>> >>\n>> >> Maybe it would be better to use a new cgitrc parameter as fallback if\n>> >> the client doesn't provide the \"Host\" header?\n>> >\n>> > That sounds a bit hackish to me since HTTP_HOST, SERVER_NAME and\n>> > SERVER_PORT are all standardized. Anyhow, it's your call :)\n>>\n>> I just figured that since SERVER_NAME/SERVER_PORT doesn't work in a\n>> setup like the one you described, clients which doesn't provide the\n>> \"Host\" header would never get a correct url. A default value for the\n>> \"Host\" header in cgitrc would work around this issue.\n>\n> Actually, in my situation, the proxy server will unconditionally set a\n> Host: header before sending the request to the lighttpd backend. Header\n> rewriting/injection is a common feature in HTTP aware proxies.\n\n\nOk, so if we assume that the \"Host\" header is only missing if the\nclient didn't specify it and there's no proxy involved, using\nSERVER_NAME/SERVER_PORT as a fallback should be ok.\n\nThanks for the patch and explanation.\n\n--\nlh\n"}]}