Commit b9b16437 authored by Joshua Slive's avatar Joshua Slive
Browse files

Change the default setting of UseCanonicalName to off and remove 

that directive from the default config.

This could use some review because it has potential security
implications.  In particular, it could cause cross-site scripting
vulnerabilities if people rely on SERVER_NAME without validating
it.  But we have been running with this in our default config file
for a while, and it vastly reduces the confusion that comes
from people setting ServerName incorrectly.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/simple-conf@160595 13f79535-47bb-0310-9956-ffa450edef68
parent 8233272c

docs/conf/extra/httpd-default.conf.in

+9 −0
Original line number Original line Diff line number Diff line
@@ -28,6 +28,15 @@ MaxKeepAliveRequests 100 
#

#

KeepAliveTimeout 15

KeepAliveTimeout 15





#

# UseCanonicalName: Determines how Apache constructs self-referencing 

# URLs and the SERVER_NAME and SERVER_PORT variables.

# When set "Off", Apache will use the Hostname and Port supplied

# by the client.  When set "On", Apache will use the value of the

# ServerName directive.

#

UseCanonicalName Off



#

#

# AccessFileName: The name of the file to look for in each directory

# AccessFileName: The name of the file to look for in each directory

# for additional configuration directives.  See also the AllowOverride 

# for additional configuration directives.  See also the AllowOverride

docs/conf/httpd.conf.in

+0 −11
Original line number Original line Diff line number Diff line
@@ -97,20 +97,9 @@ ServerAdmin you@example.com 
# it explicitly to prevent problems during startup.

# it explicitly to prevent problems during startup.

#

#

# If your host doesn't have a registered DNS name, enter its IP address here.

# If your host doesn't have a registered DNS name, enter its IP address here.

# You will have to access it by its address anyway, and this will make 

# redirections work in a sensible way.

#

#

#ServerName www.example.com:80

#ServerName www.example.com:80





#

# UseCanonicalName: Determines how Apache constructs self-referencing 

# URLs and the SERVER_NAME and SERVER_PORT variables.

# When set "Off", Apache will use the Hostname and Port supplied

# by the client.  When set "On", Apache will use the value of the

# ServerName directive.

#

UseCanonicalName Off



#

#

# DocumentRoot: The directory out of which you will serve your

# DocumentRoot: The directory out of which you will serve your

# documents. By default, all requests are taken from this directory, but

# documents. By default, all requests are taken from this directory, but

docs/manual/mod/core.xml

+1 −1
Original line number Original line Diff line number Diff line
@@ -2956,7 +2956,7 @@ certain events before failing a request</description> 
<description>Configures how the server determines its own name and

<description>Configures how the server determines its own name and

port</description>

port</description>

<syntax>UseCanonicalName On|Off|DNS</syntax>

<syntax>UseCanonicalName On|Off|DNS</syntax>

<default>UseCanonicalName On</default>

<default>UseCanonicalName Off</default>

<contextlist><context>server config</context><context>virtual host</context>

<contextlist><context>server config</context><context>virtual host</context>

<context>directory</context></contextlist>

<context>directory</context></contextlist>

server/core.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -876,8 +876,8 @@ AP_DECLARE(const char *) ap_get_server_name(request_rec *r) 
    d = (core_dir_config *)ap_get_module_config(r->per_dir_config,

    d = (core_dir_config *)ap_get_module_config(r->per_dir_config,

                                                &core_module);

                                                &core_module);





    if (d->use_canonical_name == USE_CANONICAL_NAME_OFF) {

    if (d->use_canonical_name == USE_CANONICAL_NAME_ON) {

        return r->hostname ? r->hostname : r->server->server_hostname;

        return r->server->server_hostname;

    }

    }





    if (d->use_canonical_name == USE_CANONICAL_NAME_DNS) {

    if (d->use_canonical_name == USE_CANONICAL_NAME_DNS) {
@@ -895,7 +895,7 @@ AP_DECLARE(const char *) ap_get_server_name(request_rec *r) 
    }

    }





    /* default */

    /* default */

    return r->server->server_hostname;

    return r->hostname ? r->hostname : r->server->server_hostname;

}

}





/*

/*