Http 1 1 - Learning Module

Loading content...

0/240

Host Header

The Foundation of Modern Web Hosting

Here's a number that should surprise you: there are over 1.9 billion websites on the Internet today, but only about 4.3 billion IPv4 addresses exist in total—many unavailable for public use. If every website required its own IP address, we would have exhausted the address space decades ago, and most of those websites simply couldn't exist.

The solution that made the modern web possible is elegantly simple: the Host header. Introduced as a mandatory feature in HTTP/1.1, the Host header allows clients to specify which website they want within an HTTP request, independent of the IP address they connected to. This enables virtual hosting—running hundreds, thousands, or even millions of websites on a single IP address.

Understanding the Host header is fundamental to understanding how web hosting, CDNs, reverse proxies, and load balancers work. It's one of HTTP/1.1's most impactful contributions to the web's scalability.

What You Will Learn

This page provides comprehensive coverage of the Host header: the problem it solved, why it was impossible in HTTP/1.0, the protocol mechanics, virtual hosting architectures, security implications, and its evolution in modern protocols like HTTP/2 and HTTP/3.

The HTTP/1.0 Hosting Problem

HTTP/1.0 requests contained no mechanism to identify which website the client wanted. A typical HTTP/1.0 request looked like this:

GET /index.html HTTP/1.0

The server received this request knowing only:

The client's IP address
The TCP port the client connected to (usually 80)
That the client wants /index.html

Critically missing: which website the client wants. If a server hosts example.com, another-site.org, and third-domain.net on the same IP address, how does it know which site's index.html to serve?

The HTTP/1.0 answer: it couldn't reliably tell.

Why the URL doesn't help:

You might think: "Doesn't the client's URL include the hostname?" Yes, the user types http://example.com/index.html into their browser. But HTTP/1.0 only sent the path portion (/index.html) in the request. The hostname was used solely for DNS resolution and TCP connection—it wasn't transmitted in the HTTP request itself.

The DNS resolution process:

User requests http://example.com/index.html
Browser resolves example.com → 93.184.216.34
Browser connects to 93.184.216.34:80
Browser sends: GET /index.html HTTP/1.0

By step 4, the hostname has been "lost"—the server only sees an IP connection requesting a path.

Converting Mermaid diagram...

Workarounds and their limitations:

HTTP/1.0 era web hosts developed several workarounds, all with significant drawbacks:

HTTP/1.0 Virtual Hosting Workarounds
Approach	How It Works	Limitations
One IP per site	Each website gets its own IP address	Expensive; IPv4 addresses are limited and costly
Port-based hosting	Site A on port 80, Site B on port 8080	Non-standard; URLs become ugly (example.com:8080)
Path-based hosting	Site A at /site-a/, Site B at /site-b/	Breaks site structure; cookies don't isolate properly
IP-based inference	Guess site from client IP ranges	Unreliable; doesn't scale; breaks for most clients

The IPv4 Crunch

In the 1990s, with the web exploding in popularity, the one-IP-per-site model was quickly becoming untenable. Hosting providers charged premium prices for IP addresses. Many small websites simply couldn't afford dedicated IPs. The web's growth was being constrained by addressing limitations.

The Host Header Solution

HTTP/1.1 solved the virtual hosting problem with a mandatory header: Host. Every HTTP/1.1 request must include a Host header specifying the target hostname:

GET /index.html HTTP/1.1
Host: example.com

Now the server knows exactly which site the client wants, regardless of the IP address used to connect.

Key protocol requirements:

Host header is mandatory: HTTP/1.1 requests without a Host header are invalid (400 Bad Request)
Must match the request-target: If using an absolute URI, Host must match it
Exactly one Host header: Multiple Host headers make the request invalid
May include port: Host: example.com:8080 specifies non-default port
Empty Host allowed: For certain cases (like CONNECT tunnels)

host-header-examples.http
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
# Valid HTTP/1.1 request with Host header
GET /products/widget HTTP/1.1
Host: shop.example.com
Accept: text/html
Connection: keep-alive
 
# ================================================
# Valid HTTP/1.1 request with port in Host
GET /api/v1/users HTTP/1.1
Host: api.example.com:3000
Accept: application/json
 
# ================================================
# Invalid: HTTP/1.1 without Host header (400 error)
GET /page HTTP/1.1
Accept: text/html
 
# Server response:
# HTTP/1.1 400 Bad Request
# Content-Type: text/plain
# Missing Host header
 
# ================================================
# Invalid: Multiple Host headers (400 error)
GET /page HTTP/1.1
Host: site1.com
Host: site2.com
Accept: text/html
 
# Server response:
# HTTP/1.1 400 Bad Request
# Multiple Host headers
 
# ================================================
# Absolute URI request (Host must match)
GET http://example.com/page HTTP/1.1
Host: example.com
 
# If Host differs from absolute URI, server may reject

Why Not Just Use Absolute URIs?

HTTP/1.1 technically allows absolute URIs in the request line (GET http://example.com/path HTTP/1.1), which would include the host. However, most clients use the shorter origin-form (GET /path) for efficiency. The Host header provides the hostname without changing the request line format. Proxies receiving absolute URI requests typically use them for routing decisions.

Server-side routing with Host header:

Modern web servers use the Host header as the primary routing key for virtual hosting:

Incoming Request:
  TCP connection to: 93.184.216.34:80
  Host header: shop.example.com

Server Routing Decision:
  1. Parse Host header: "shop.example.com"
  2. Look up virtual host configuration
  3. Route to shop.example.com's document root
  4. Apply shop.example.com's configuration
  5. Generate response for shop.example.com

This routing happens entirely at the HTTP layer, independent of IP addresses or TCP ports.

Virtual Hosting Architectures

The Host header enabled several virtual hosting architectures, each suited to different scales and requirements.

Name-based virtual hosting:

The most common approach, where multiple domain names share a single IP address:

IP: 93.184.216.34
├── example.com       → /var/www/example.com/
├── another-site.org  → /var/www/another-site/
├── third-domain.net  → /var/www/third-domain/
└── my-blog.io        → /var/www/my-blog/

The server inspects the Host header and routes to the appropriate content directory. A single server can host thousands of sites this way.

nginx-virtual-hosts.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
# Nginx name-based virtual hosting configuration
# All virtual hosts share the same IP and port
 
# Virtual host 1: example.com
server {
    listen 80;
    server_name example.com www.example.com;
    
    root /var/www/example.com;
    index index.html;
    
    location / {
        try_files $uri $uri/ =404;
    }
}
 
# Virtual host 2: shop.example.com
server {
    listen 80;
    server_name shop.example.com;
    
    root /var/www/shop;
    
    location / {
        proxy_pass http://localhost:3000;
    }
}
 
# Virtual host 3: api.example.com
server {
    listen 80;
    server_name api.example.com;
    
    location / {
        proxy_pass http://backend-api-cluster;
        proxy_set_header Host $host;  # Forward Host header
    }
}
 
# Default server for unknown Host headers
server {
    listen 80 default_server;
    server_name _;
    
    return 444;  # Close connection without response
}

Shared hosting at scale:

Major hosting providers use virtual hosting to serve millions of websites:

Provider Scale	Typical Configuration
Small shared host	100-500 sites per server
Medium host	1,000-10,000 sites per server
Large platforms (WordPress.com, etc.)	100,000+ sites per service
CDN edge nodes	Millions of domains per edge location

The Host header makes this scale economically viable.

Name-Based Hosting Pros

•Single IP for unlimited sites
•Cost-effective hosting
•Simple DNS configuration
•Easy to add new sites
•Standard, well-supported

Name-Based Hosting Cons

•HTTPS complexity (SNI required)
•All sites share server resources
•Noisy neighbor problems
•Limited per-site customization
•Security isolation challenges

IP-Based vs. Name-Based Hosting

IP-based hosting (each site gets its own IP) still has use cases: sites needing dedicated SSL certificates without SNI support, applications requiring specific IP whitelisting, or situations where maximum isolation is required. However, name-based hosting handles 99%+ of use cases efficiently.

Host Header and HTTPS: The SNI Solution

The Host header elegantly solved virtual hosting for HTTP, but HTTPS introduced a new challenge. The problem: TLS encryption begins before any HTTP headers are sent.

The HTTPS chicken-and-egg problem:

Client connects to server IP on port 443
TLS handshake begins
Server must present an SSL certificate
But... which certificate? The server doesn't yet know which site the client wants!
Host header won't be sent until after TLS is established

If a server hosts 100 sites with different SSL certificates, it can't determine which certificate to present—the Host header arrives too late in the protocol sequence.

Converting Mermaid diagram...

Server Name Indication (SNI):

SNI, defined in RFC 6066, extends TLS to include the desired hostname in the ClientHello message—before certificate selection occurs:

ClientHello:
  - Supported TLS versions
  - Cipher suites
  - Extension: server_name = "shop.example.com"  ← SNI extension
  - Other extensions...

With SNI, the server knows immediately which site the client wants and can select the appropriate certificate.

nginx-sni-ssl.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# Nginx HTTPS virtual hosting with SNI
# Each virtual host has its own SSL certificate
 
# Site 1: shop.example.com
server {
    listen 443 ssl http2;
    server_name shop.example.com;
    
    # Site-specific certificate
    ssl_certificate /etc/letsencrypt/live/shop.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/shop.example.com/privkey.pem;
    
    root /var/www/shop;
}
 
# Site 2: blog.example.com  
server {
    listen 443 ssl http2;
    server_name blog.example.com;
    
    # Different certificate for this site
    ssl_certificate /etc/letsencrypt/live/blog.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/blog.example.com/privkey.pem;
    
    root /var/www/blog;
}
 
# Site 3: api.example.com
server {
    listen 443 ssl http2;
    server_name api.example.com;
    
    # Wildcard certificate covers multiple subdomains
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    location / {
        proxy_pass http://api-backend;
    }
}

SNI Privacy Concern

SNI sends the hostname in plaintext during the TLS handshake—visible to network observers even though the subsequent HTTP traffic is encrypted. This allows ISPs and firewalls to see which sites users visit. Encrypted ClientHello (ECH), formerly called ESNI, is an emerging solution that encrypts the SNI extension.

SNI adoption and legacy concerns:

Client Type	SNI Support
Modern browsers (Chrome, Firefox, Safari, Edge)	Full support since 2010+
Internet Explorer	IE 7+ on Vista+; IE 6 and XP: No
Android	Android 3.0+ (2011)
iOS	iOS 4+ (2010)
Java	Java 7+
Python	Python 2.7.9+ / Python 3.2+
cURL	7.18.1+ (2008)

Today, SNI support is nearly universal. Legacy clients without SNI receive the server's default certificate, which may trigger certificate warnings.

Reverse Proxies and Load Balancers

The Host header is central to how reverse proxies and load balancers route traffic. These components sit between clients and backend servers, using the Host header to make routing decisions.

Reverse proxy routing:

Client Request:
  Host: shop.example.com
  GET /products/123
        ↓
Reverse Proxy (e.g., Nginx, HAProxy):
  Route based on Host header:
    - shop.example.com → backend-shop:8080
    - api.example.com → backend-api:3000
    - *.example.com → backend-default:8000
        ↓
Backend Server:
  Receives request with Host header intact
  (or modified X-Forwarded-Host)

haproxy-host-routing.cfg
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
# HAProxy configuration for Host-based routing
global
    log stdout format raw local0
 
defaults
    mode http
    timeout connect 5s
    timeout client 50s
    timeout server 50s
 
frontend http_front
    bind *:80
    
    # Route based on Host header using ACLs
    acl is_shop hdr(host) -i shop.example.com
    acl is_api hdr(host) -i api.example.com
    acl is_blog hdr(host) -i blog.example.com
    acl is_subdomain hdr_end(host) -i .example.com
    
    # Use backend based on Host
    use_backend shop_backend if is_shop
    use_backend api_backend if is_api
    use_backend blog_backend if is_blog
    use_backend wildcard_backend if is_subdomain
    
    default_backend fallback_backend
 
backend shop_backend
    balance roundrobin
    server shop1 10.0.1.1:8080 check
    server shop2 10.0.1.2:8080 check
    # Preserve original Host header
    http-request set-header X-Forwarded-Host %[req.hdr(host)]
 
backend api_backend
    balance leastconn
    server api1 10.0.2.1:3000 check
    server api2 10.0.2.2:3000 check
 
backend blog_backend
    server blog1 10.0.3.1:8000 check
 
backend wildcard_backend
    server default1 10.0.4.1:8000 check
 
backend fallback_backend
    http-request deny deny_status 404

X-Forwarded-Host and Host preservation:

When proxies forward requests to backends, they face a decision: should the Host header reflect the original client request, or the backend server?

Scenario	Host Header Behavior
Preserve Host	Forward original `Host: shop.example.com` to backend
Rewrite Host	Change to `Host: backend-server:8080`

Most configurations preserve the original Host header, allowing backends to generate correct URLs and apply per-domain logic. The original client Host is often also preserved in X-Forwarded-Host:

GET /products/123 HTTP/1.1
Host: shop.example.com
X-Forwarded-Host: shop.example.com
X-Forwarded-For: 203.0.113.50
X-Forwarded-Proto: https

Multi-Tenant Routing

SaaS platforms often use Host-based routing for multi-tenancy. Each customer gets a subdomain (customer1.saas-app.com, customer2.saas-app.com), and the proxy routes to appropriate backends or extracts tenant ID from the Host header. This pattern scales to millions of tenants on shared infrastructure.

Security Implications

The Host header is a client-controlled input, which makes it a potential attack vector. Several security vulnerabilities relate to improper Host header handling.

Host header injection:

If an application uses the Host header to generate URLs without validation, attackers can inject malicious hosts:

# Malicious request
GET /reset-password?token=abc123 HTTP/1.1
Host: attacker.com

# Vulnerable application generates email:
"Click here to reset: http://attacker.com/reset?token=abc123"

# Victim clicks link, sends token to attacker's server

Applications must validate Host headers against a whitelist of expected values.

host-validation.ts
TypeScript
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
// Secure Host header validation
const ALLOWED_HOSTS = new Set([
    'example.com',
    'www.example.com',
    'shop.example.com',
    'localhost',        // Development
    '127.0.0.1',        // Development
]);
 
function validateHostHeader(request: Request): boolean {
    const host = request.headers.get('host');
    
    if (!host) {
        return false; // Host header is required in HTTP/1.1
    }
    
    // Extract hostname (remove port if present)
    const hostname = host.split(':')[0].toLowerCase();
    
    // Validate against whitelist
    if (!ALLOWED_HOSTS.has(hostname)) {
        console.warn(`Rejected invalid Host header: ${host}`);
        return false;
    }
    
    return true;
}
 
// URL generation should use configured host, not request Host
function generateCanonicalUrl(path: string): string {
    const configuredHost = process.env.CANONICAL_HOST || 'example.com';
    const protocol = process.env.USE_HTTPS ? 'https' : 'http';
    
    // Never use request Host header directly for URL generation
    return `${protocol}://${configuredHost}${path}`;
}
 
// Middleware to reject invalid hosts early
function hostValidationMiddleware(req: Request, res: Response, next: Function) {
    if (!validateHostHeader(req)) {
        res.status(400).json({ error: 'Invalid Host header' });
        return;
    }
    next();
}

Additional Host header security concerns:

Security Vulnerabilities

•Password reset poisoning — Attacker-controlled Host in reset emails leads victims to attacker sites
•Web cache poisoning — Different Host values cause caches to store attacker-controlled content under legitimate URLs
•Server-side request forgery (SSRF) — Host header used in backend requests to access internal services
•Virtual host confusion — Accessing one site's content through another site's Host header
•Open redirect — Host-based redirects can be manipulated to redirect to malicious sites
•Routing bypass — Crafted Host headers might route to unintended backends in proxy configurations

Never Trust the Host Header

The Host header is entirely client-controlled and trivially spoofable. Applications must validate it against allowed values, and URL generation should use server configuration—not request headers. Many high-profile vulnerabilities stem from trusting Host headers for security-sensitive operations.

Evolution: Host in HTTP/2 and HTTP/3

HTTP/2 and HTTP/3 evolved how the host is communicated, though the underlying concept remains essential.

HTTP/2's :authority pseudo-header:

HTTP/2 replaced the Host header with the :authority pseudo-header. This header contains the same information but is part of HTTP/2's new header format:

HTTP/1.1:
  GET /products HTTP/1.1
  Host: shop.example.com

HTTP/2:
  :method: GET
  :path: /products
  :authority: shop.example.com  ← Replaces Host
  :scheme: https

When HTTP/2 messages are translated to HTTP/1.1 (e.g., by a proxy speaking HTTP/2 to clients but HTTP/1.1 to backends), :authority becomes the Host header.

Host Information Across HTTP Versions
HTTP Version	Header/Field	Format	Required?
HTTP/1.0	None (or non-standard)	N/A	No
HTTP/1.1	`Host`	`Host: example.com[:port]`	Yes (mandatory)
HTTP/2	`:authority`	`:authority: example.com[:port]`	Yes (or :host)
HTTP/3	`:authority`	`:authority: example.com[:port]`	Yes

Connection coalescing and Host:

HTTP/2 introduces an interesting optimization: connection coalescing. If a server's certificate covers multiple domains (e.g., a wildcard or SAN certificate), a single HTTP/2 connection can serve requests to all those domains:

HTTP/2 Connection to: 93.184.216.34
Server certificate covers: *.example.com

Stream 1: :authority = shop.example.com → /products
Stream 3: :authority = api.example.com → /v1/users
Stream 5: :authority = cdn.example.com → /assets/logo.png

All three domains on one connection!

This coalescing uses :authority (or Host) to route within a multiplexed connection, rather than for initial connection selection.

Backwards Compatibility

HTTP/2 servers speaking to HTTP/1.1 backends must convert :authority to Host. Similarly, HTTP/1.1 clients upgraded to HTTP/2 don't need to change—the browser handles the Host-to-:authority translation transparently. The virtual hosting concept remains unchanged even as the wire format evolves.

Summary: Host Header

The Host header is one of HTTP/1.1's most consequential innovations—a simple addition that enabled the modern web's scale. Without it, the Internet would be constrained by IPv4 address limitations, and web hosting would be prohibitively expensive for most users.

Key Takeaways

•HTTP/1.0 couldn't identify target sites — DNS resolved hostnames to IPs, but the hostname wasn't in HTTP requests
•Host header is mandatory in HTTP/1.1 — Every request must include Host, specifying the target domain
•Virtual hosting enables many sites on one IP — Servers route requests based on Host header, not network address
•SNI extends virtual hosting to HTTPS — TLS ClientHello includes server name for certificate selection
•Reverse proxies use Host for routing — Load balancers and CDNs route traffic based on Host header values
•Host header is a security-sensitive input — Applications must validate and never trust it blindly
•HTTP/2+ uses :authority — The concept persists in modern protocols with evolved syntax

What's next:

With the Host header enabling efficient multi-site hosting, we'll examine the performance characteristics and limitations of HTTP/1.1 as a whole. Despite its innovations—persistent connections, chunked encoding, the Host header—HTTP/1.1 has fundamental constraints that eventually necessitated HTTP/2. The final page explores these performance issues and sets the stage for understanding HTTP/2's design goals.

Page Complete

You now understand the Host header comprehensively: the problem it solved, its mandatory nature in HTTP/1.1, virtual hosting architectures, SNI for HTTPS, reverse proxy routing, security implications, and evolution in HTTP/2 and HTTP/3. This knowledge is fundamental to understanding how modern web infrastructure scales to billions of websites.

Host Header

The Foundation of Modern Web Hosting

What You Will Learn

The HTTP/1.0 Hosting Problem

HTTP/1.0 requests contained no mechanism to identify which website the client wanted. A typical HTTP/1.0 request looked like this:

GET /index.html HTTP/1.0

The server received this request knowing only:

The client's IP address
The TCP port the client connected to (usually 80)
That the client wants /index.html

The HTTP/1.0 answer: it couldn't reliably tell.

Why the URL doesn't help:

The DNS resolution process:

User requests http://example.com/index.html
Browser resolves example.com → 93.184.216.34
Browser connects to 93.184.216.34:80
Browser sends: GET /index.html HTTP/1.0

By step 4, the hostname has been "lost"—the server only sees an IP connection requesting a path.

Converting Mermaid diagram...

Workarounds and their limitations:

HTTP/1.0 era web hosts developed several workarounds, all with significant drawbacks:

HTTP/1.0 Virtual Hosting Workarounds
Approach	How It Works	Limitations
One IP per site	Each website gets its own IP address	Expensive; IPv4 addresses are limited and costly
Port-based hosting	Site A on port 80, Site B on port 8080	Non-standard; URLs become ugly (example.com:8080)
Path-based hosting	Site A at /site-a/, Site B at /site-b/	Breaks site structure; cookies don't isolate properly
IP-based inference	Guess site from client IP ranges	Unreliable; doesn't scale; breaks for most clients

The IPv4 Crunch

The Host Header Solution

HTTP/1.1 solved the virtual hosting problem with a mandatory header: Host. Every HTTP/1.1 request must include a Host header specifying the target hostname:

GET /index.html HTTP/1.1
Host: example.com

Now the server knows exactly which site the client wants, regardless of the IP address used to connect.

Key protocol requirements:

Host header is mandatory: HTTP/1.1 requests without a Host header are invalid (400 Bad Request)
Must match the request-target: If using an absolute URI, Host must match it
Exactly one Host header: Multiple Host headers make the request invalid
May include port: Host: example.com:8080 specifies non-default port
Empty Host allowed: For certain cases (like CONNECT tunnels)

host-header-examples.http
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
# Valid HTTP/1.1 request with Host header
GET /products/widget HTTP/1.1
Host: shop.example.com
Accept: text/html
Connection: keep-alive
 
# ================================================
# Valid HTTP/1.1 request with port in Host
GET /api/v1/users HTTP/1.1
Host: api.example.com:3000
Accept: application/json
 
# ================================================
# Invalid: HTTP/1.1 without Host header (400 error)
GET /page HTTP/1.1
Accept: text/html
 
# Server response:
# HTTP/1.1 400 Bad Request
# Content-Type: text/plain
# Missing Host header
 
# ================================================
# Invalid: Multiple Host headers (400 error)
GET /page HTTP/1.1
Host: site1.com
Host: site2.com
Accept: text/html
 
# Server response:
# HTTP/1.1 400 Bad Request
# Multiple Host headers
 
# ================================================
# Absolute URI request (Host must match)
GET http://example.com/page HTTP/1.1
Host: example.com
 
# If Host differs from absolute URI, server may reject

Why Not Just Use Absolute URIs?

Server-side routing with Host header:

Modern web servers use the Host header as the primary routing key for virtual hosting:

Incoming Request:
  TCP connection to: 93.184.216.34:80
  Host header: shop.example.com

Server Routing Decision:
  1. Parse Host header: "shop.example.com"
  2. Look up virtual host configuration
  3. Route to shop.example.com's document root
  4. Apply shop.example.com's configuration
  5. Generate response for shop.example.com

This routing happens entirely at the HTTP layer, independent of IP addresses or TCP ports.

Virtual Hosting Architectures

The Host header enabled several virtual hosting architectures, each suited to different scales and requirements.

Name-based virtual hosting:

The most common approach, where multiple domain names share a single IP address:

IP: 93.184.216.34
├── example.com       → /var/www/example.com/
├── another-site.org  → /var/www/another-site/
├── third-domain.net  → /var/www/third-domain/
└── my-blog.io        → /var/www/my-blog/

The server inspects the Host header and routes to the appropriate content directory. A single server can host thousands of sites this way.

nginx-virtual-hosts.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
# Nginx name-based virtual hosting configuration
# All virtual hosts share the same IP and port
 
# Virtual host 1: example.com
server {
    listen 80;
    server_name example.com www.example.com;
    
    root /var/www/example.com;
    index index.html;
    
    location / {
        try_files $uri $uri/ =404;
    }
}
 
# Virtual host 2: shop.example.com
server {
    listen 80;
    server_name shop.example.com;
    
    root /var/www/shop;
    
    location / {
        proxy_pass http://localhost:3000;
    }
}
 
# Virtual host 3: api.example.com
server {
    listen 80;
    server_name api.example.com;
    
    location / {
        proxy_pass http://backend-api-cluster;
        proxy_set_header Host $host;  # Forward Host header
    }
}
 
# Default server for unknown Host headers
server {
    listen 80 default_server;
    server_name _;
    
    return 444;  # Close connection without response
}

Shared hosting at scale:

Major hosting providers use virtual hosting to serve millions of websites:

Provider Scale	Typical Configuration
Small shared host	100-500 sites per server
Medium host	1,000-10,000 sites per server
Large platforms (WordPress.com, etc.)	100,000+ sites per service
CDN edge nodes	Millions of domains per edge location

The Host header makes this scale economically viable.

Name-Based Hosting Pros

•Single IP for unlimited sites
•Cost-effective hosting
•Simple DNS configuration
•Easy to add new sites
•Standard, well-supported

Name-Based Hosting Cons

•HTTPS complexity (SNI required)
•All sites share server resources
•Noisy neighbor problems
•Limited per-site customization
•Security isolation challenges

IP-Based vs. Name-Based Hosting

Host Header and HTTPS: The SNI Solution

The Host header elegantly solved virtual hosting for HTTP, but HTTPS introduced a new challenge. The problem: TLS encryption begins before any HTTP headers are sent.

The HTTPS chicken-and-egg problem:

Client connects to server IP on port 443
TLS handshake begins
Server must present an SSL certificate
But... which certificate? The server doesn't yet know which site the client wants!
Host header won't be sent until after TLS is established

If a server hosts 100 sites with different SSL certificates, it can't determine which certificate to present—the Host header arrives too late in the protocol sequence.

Converting Mermaid diagram...

Server Name Indication (SNI):

SNI, defined in RFC 6066, extends TLS to include the desired hostname in the ClientHello message—before certificate selection occurs:

ClientHello:
  - Supported TLS versions
  - Cipher suites
  - Extension: server_name = "shop.example.com"  ← SNI extension
  - Other extensions...

With SNI, the server knows immediately which site the client wants and can select the appropriate certificate.

nginx-sni-ssl.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# Nginx HTTPS virtual hosting with SNI
# Each virtual host has its own SSL certificate
 
# Site 1: shop.example.com
server {
    listen 443 ssl http2;
    server_name shop.example.com;
    
    # Site-specific certificate
    ssl_certificate /etc/letsencrypt/live/shop.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/shop.example.com/privkey.pem;
    
    root /var/www/shop;
}
 
# Site 2: blog.example.com  
server {
    listen 443 ssl http2;
    server_name blog.example.com;
    
    # Different certificate for this site
    ssl_certificate /etc/letsencrypt/live/blog.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/blog.example.com/privkey.pem;
    
    root /var/www/blog;
}
 
# Site 3: api.example.com
server {
    listen 443 ssl http2;
    server_name api.example.com;
    
    # Wildcard certificate covers multiple subdomains
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    location / {
        proxy_pass http://api-backend;
    }
}

SNI Privacy Concern

SNI adoption and legacy concerns:

Client Type	SNI Support
Modern browsers (Chrome, Firefox, Safari, Edge)	Full support since 2010+
Internet Explorer	IE 7+ on Vista+; IE 6 and XP: No
Android	Android 3.0+ (2011)
iOS	iOS 4+ (2010)
Java	Java 7+
Python	Python 2.7.9+ / Python 3.2+
cURL	7.18.1+ (2008)

Today, SNI support is nearly universal. Legacy clients without SNI receive the server's default certificate, which may trigger certificate warnings.

Reverse Proxies and Load Balancers

The Host header is central to how reverse proxies and load balancers route traffic. These components sit between clients and backend servers, using the Host header to make routing decisions.

Reverse proxy routing:

Client Request:
  Host: shop.example.com
  GET /products/123
        ↓
Reverse Proxy (e.g., Nginx, HAProxy):
  Route based on Host header:
    - shop.example.com → backend-shop:8080
    - api.example.com → backend-api:3000
    - *.example.com → backend-default:8000
        ↓
Backend Server:
  Receives request with Host header intact
  (or modified X-Forwarded-Host)

haproxy-host-routing.cfg
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
# HAProxy configuration for Host-based routing
global
    log stdout format raw local0
 
defaults
    mode http
    timeout connect 5s
    timeout client 50s
    timeout server 50s
 
frontend http_front
    bind *:80
    
    # Route based on Host header using ACLs
    acl is_shop hdr(host) -i shop.example.com
    acl is_api hdr(host) -i api.example.com
    acl is_blog hdr(host) -i blog.example.com
    acl is_subdomain hdr_end(host) -i .example.com
    
    # Use backend based on Host
    use_backend shop_backend if is_shop
    use_backend api_backend if is_api
    use_backend blog_backend if is_blog
    use_backend wildcard_backend if is_subdomain
    
    default_backend fallback_backend
 
backend shop_backend
    balance roundrobin
    server shop1 10.0.1.1:8080 check
    server shop2 10.0.1.2:8080 check
    # Preserve original Host header
    http-request set-header X-Forwarded-Host %[req.hdr(host)]
 
backend api_backend
    balance leastconn
    server api1 10.0.2.1:3000 check
    server api2 10.0.2.2:3000 check
 
backend blog_backend
    server blog1 10.0.3.1:8000 check
 
backend wildcard_backend
    server default1 10.0.4.1:8000 check
 
backend fallback_backend
    http-request deny deny_status 404

X-Forwarded-Host and Host preservation:

When proxies forward requests to backends, they face a decision: should the Host header reflect the original client request, or the backend server?

Scenario	Host Header Behavior
Preserve Host	Forward original `Host: shop.example.com` to backend
Rewrite Host	Change to `Host: backend-server:8080`

Most configurations preserve the original Host header, allowing backends to generate correct URLs and apply per-domain logic. The original client Host is often also preserved in X-Forwarded-Host:

GET /products/123 HTTP/1.1
Host: shop.example.com
X-Forwarded-Host: shop.example.com
X-Forwarded-For: 203.0.113.50
X-Forwarded-Proto: https

Multi-Tenant Routing

Security Implications

The Host header is a client-controlled input, which makes it a potential attack vector. Several security vulnerabilities relate to improper Host header handling.

Host header injection:

If an application uses the Host header to generate URLs without validation, attackers can inject malicious hosts:

# Malicious request
GET /reset-password?token=abc123 HTTP/1.1
Host: attacker.com

# Vulnerable application generates email:
"Click here to reset: http://attacker.com/reset?token=abc123"

# Victim clicks link, sends token to attacker's server

Applications must validate Host headers against a whitelist of expected values.

host-validation.ts
TypeScript
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
// Secure Host header validation
const ALLOWED_HOSTS = new Set([
    'example.com',
    'www.example.com',
    'shop.example.com',
    'localhost',        // Development
    '127.0.0.1',        // Development
]);
 
function validateHostHeader(request: Request): boolean {
    const host = request.headers.get('host');
    
    if (!host) {
        return false; // Host header is required in HTTP/1.1
    }
    
    // Extract hostname (remove port if present)
    const hostname = host.split(':')[0].toLowerCase();
    
    // Validate against whitelist
    if (!ALLOWED_HOSTS.has(hostname)) {
        console.warn(`Rejected invalid Host header: ${host}`);
        return false;
    }
    
    return true;
}
 
// URL generation should use configured host, not request Host
function generateCanonicalUrl(path: string): string {
    const configuredHost = process.env.CANONICAL_HOST || 'example.com';
    const protocol = process.env.USE_HTTPS ? 'https' : 'http';
    
    // Never use request Host header directly for URL generation
    return `${protocol}://${configuredHost}${path}`;
}
 
// Middleware to reject invalid hosts early
function hostValidationMiddleware(req: Request, res: Response, next: Function) {
    if (!validateHostHeader(req)) {
        res.status(400).json({ error: 'Invalid Host header' });
        return;
    }
    next();
}

Additional Host header security concerns:

Security Vulnerabilities

•Password reset poisoning — Attacker-controlled Host in reset emails leads victims to attacker sites
•Web cache poisoning — Different Host values cause caches to store attacker-controlled content under legitimate URLs
•Server-side request forgery (SSRF) — Host header used in backend requests to access internal services
•Virtual host confusion — Accessing one site's content through another site's Host header
•Open redirect — Host-based redirects can be manipulated to redirect to malicious sites
•Routing bypass — Crafted Host headers might route to unintended backends in proxy configurations

Never Trust the Host Header

Evolution: Host in HTTP/2 and HTTP/3

HTTP/2 and HTTP/3 evolved how the host is communicated, though the underlying concept remains essential.

HTTP/2's :authority pseudo-header:

HTTP/2 replaced the Host header with the :authority pseudo-header. This header contains the same information but is part of HTTP/2's new header format:

HTTP/1.1:
  GET /products HTTP/1.1
  Host: shop.example.com

HTTP/2:
  :method: GET
  :path: /products
  :authority: shop.example.com  ← Replaces Host
  :scheme: https

When HTTP/2 messages are translated to HTTP/1.1 (e.g., by a proxy speaking HTTP/2 to clients but HTTP/1.1 to backends), :authority becomes the Host header.

Host Information Across HTTP Versions
HTTP Version	Header/Field	Format	Required?
HTTP/1.0	None (or non-standard)	N/A	No
HTTP/1.1	`Host`	`Host: example.com[:port]`	Yes (mandatory)
HTTP/2	`:authority`	`:authority: example.com[:port]`	Yes (or :host)
HTTP/3	`:authority`	`:authority: example.com[:port]`	Yes

Connection coalescing and Host:

HTTP/2 Connection to: 93.184.216.34
Server certificate covers: *.example.com

Stream 1: :authority = shop.example.com → /products
Stream 3: :authority = api.example.com → /v1/users
Stream 5: :authority = cdn.example.com → /assets/logo.png

All three domains on one connection!

This coalescing uses :authority (or Host) to route within a multiplexed connection, rather than for initial connection selection.

Backwards Compatibility

Summary: Host Header

Key Takeaways

•HTTP/1.0 couldn't identify target sites — DNS resolved hostnames to IPs, but the hostname wasn't in HTTP requests
•Host header is mandatory in HTTP/1.1 — Every request must include Host, specifying the target domain
•Virtual hosting enables many sites on one IP — Servers route requests based on Host header, not network address
•SNI extends virtual hosting to HTTPS — TLS ClientHello includes server name for certificate selection
•Reverse proxies use Host for routing — Load balancers and CDNs route traffic based on Host header values
•Host header is a security-sensitive input — Applications must validate and never trust it blindly
•HTTP/2+ uses :authority — The concept persists in modern protocols with evolved syntax

What's next:

Page Complete