www-apache-bugdb mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From m...@apache.org
Subject Re: general/4393: Apache without mod_proxy does not give an error when it gets a proxy-request.
Date Sat, 22 Sep 2001 17:01:34 GMT
[In order for any reply to be added to the PR database, you need]
[to include <apbugs@Apache.Org> in the Cc line and make sure the]
[subject line starts with the report component and number, with ]
[or without any 'Re:' prefixes (such as "general/1098:" or      ]
["Re: general/1098:").  If the subject doesn't match this       ]
[pattern, your message will be misfiled and ignored.  The       ]
["apbugs" address is not added to the Cc line of messages from  ]
[the database automatically because of the potential for mail   ]
[loops.  If you do not include this Cc, your reply may be ig-   ]
[nored unless you are responding to an explicit request from a  ]
[developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]


Synopsis: Apache without mod_proxy does not give an error when it gets a proxy-request.

State-Changed-From-To: open-closed
State-Changed-By: marc
State-Changed-When: Sat Sep 22 10:01:34 PDT 2001
State-Changed-Why:
This is not a bug.

HTTP/1.1 requires that servers accept requests in the form
http://server/foo for local pages.  It can not simply refuse such requests if the proxy is
not enabled.

By default, Apache is configured with a default virtualhost that serves requests for requests
to "unknown" virtual servers on the machine.  This is used by many people because there are
many names that can be used to refer to a server in some environments, and people often want
them all to work.


If you want that default virtual host to give a 404 or other error page, you can certainly
configure it to do that.  But if you don't, then Apache simply can't know if "server" does
or does not refer to the local machine.  It can try to do a DNS lookup on the name given,
but that is a far far bigger DoS in and of itself and isn't sufficient anyway for various
reasons.




Mime
View raw message