Re: [Phpwiki-talk] Bug#168137: phpwiki: HTTP_HOST should be used instead of SERVER_NAME in config.php (fwd)

[Matthew P. <mj...@ie...>]

On Thu, 7 Nov 2002, Jeff Dairiki wrote:

> According to the CGI spec (http://hoohoo.ncsa.uiuc.edu/cgi/env.html)
> SERVER_NAME should be "The server's hostname, DNS alias, or IP address
> as it would appear in self-referencing URLs."

Well, that certainly puts the tin hat on it.  If that's what we're supposed
to be using in self-referential links according to the spec, that kind of
answers the question permanently.

> SERVER_NAME can be explicitly set in the apache config file
> using the ServerName directive.   See:
>   http://httpd.apache.org/docs/mod/core.html#servername

Just a question off the topic since it just popped into my head - can you
set SERVER_NAME on a per-VHost basis?  I should probably just try it, I
guess.

> If he doesn't want to muck with the Apache config, the PhpWiki admin
> can also explicitly define PhpWiki's SERVER_NAME in the PhpWiki config
> file (index.php).   $HTTP_SERVER_VARS['SERVER_NAME']
> is only used as the default when the admin hasn't specified a
> value for SERVER_NAME in the config file.

Which is a reasonable alternative.

> (The PhpWiki admin is, of course also allowed to put something like
>   define('SERVER_NAME', $_SERVER['HTTP_HOST']);
> into index.php if that's really what s/he wants.)

Heh, quite a reasonable way to do it if that's the desired functionality.

> As far as what to use for the default, auto-detected case,
> it's not clear to me that $HTTP_SERVER_VARS['HTTP_HOST'] would
> work better than $HTTP_SERVER_VARS['SERVER_NAME'] in the majority
> of cases. 

It would work, to my way of thinking, from the point of view that if the
client has used that name to get to the server in the first place, it would
be reasonable to expect it to work for the next request...

> Another concern is that, 'HTTP_HOST' comes from the browser 
> (client), passed in one of the Host: header of the HTTP request ---
> so there may be some security issues involved as well.

Mmmm... not a security expert, but nothing comes to mind off the top of my
head.  But trusting anything from the client-side is never recommended...
<g>

> The real intended use of HTTP_HOST is for use in virtual hosting
> situations where multiple virtual hosts share the same IP address.
> Generally, it's used by the server (apache) to determine which 
> virtual host to direct the request to...

Which is kinda the reason for my question above - can ServerName be set on a
per-VHost basis?  If not, you'd need to use HTTP_HOST or manually set
SERVER_NAME in PHPWiki for each VHost you wanted to have Wikiing.  Of
course, you're going to have to have some sort of separate config for each
independent Wiki, but I thought it might save a bit of work to have one less
config item to set for each VHost.

At the end of the day, though, the CGI spec says "Thou shalt use SERVER_NAME
for self-referencing URLs" so, in the absence of anything really
show-stopping to the contrary, I'll take the spec's word for it.

- Matt