6

I would like Nginx to 444 when processing a request without a host header.

I have read http://nginx.org/en/docs/http/request_processing.html and Nginx default host when not defined, where it says: 

"If its value does not match any server name, or the request does not contain
this header field at all, then nginx will route the request to the default server 
for this port."

I've configured

server {
  listen 80 default_server;

  # Since version 0.8.48, this is the default setting for the server name, 
  # so the server_name "" can be omitted.
  # server_name "";

  return 444;
}

Then I request

telnet localhost 80<enter>
GET / HTTP/1.1<enter>
<enter>

and receive a 400, not the 444 I expected:

HTTP/1.1 400 Bad Request
Server: nginx/1.2.5
Date: Wed, 28 Nov 2012 21:01:59 GMT
Content-Type: text/html
Content-Length: 172
Connection: close

[body]

The same happens when I

telnet localhost 80<enter>
GET / HTTP/1.1<enter>
Host:<enter>

How can I get Nginx to 444 when no host header is provided? Is this not possible if the the server considers the request a bad request?

Community
  • 1
Dmitry Minkovsky
  • 557
  • 3
  • 9
  • 22

2 Answers2

6

From RFC 9112 "HTTP/1.1", section "3.2 Request Target":

A server MUST respond with a 400 (Bad Request) status code to any HTTP/1.1 request message that lacks a Host header field and to any request message that contains more than one Host header field line or a Host header field with an invalid field value.

toraritte
  • 200
  • 10
Dennis Kaarsemaker
  • 19,277
  • 2
  • 44
  • 70
  • Latest list of [HTTP resources and specifications](https://developer.mozilla.org/en-US/docs/Web/HTTP/Resources_and_specifications). – toraritte Jun 05 '23 at 14:22
4

You can still catch the 400 error and return a 444 instead. The following worked for me on requests without a Host header

server {
        listen      80;
        server_name "";
        return      444;
        error_page 400 = @400;
        location @400 {
                return 444;
        }
}

PS you still get a 400 if you don't send a GET /xxx HTTP/1.x, POST /xxx HTTP/1.x, HEAD /xxx HTTP/1.x, or strangely just GET /.

Gerben
  • 141
  • 3