Tricky SERVER_NAME and HTTP_HOST return values?

[Bill]

These two server variables should ALWAYS return the domain name of the host:

- Request.ServerVariables("SERVER_NAME")
- Request.ServerVariables("HTTP_HOST")

Under what circumstances can those server variables return the server names of domains
that are completely unrelated to the hosting website???

I know, it's not supposed to work that way, but it is. I'm seeing almost 30,000
accesses/day on an empty website, no less!

For each entry, as a debugging mechanism I decided to log all the
Request.ServerVariables entries, and that's when I noticed the outrageous behavior of
the above two server variables.

How is this technically, possible???

(I should note that Request.ServerVariables("HTTP_REFERER") always returns the proper IP
address for the website. Also, I believe I know WHAT is causing this traffic, but to
prevent defensive answers on this group I don't want to mention that yet.)

THANKS!!!

Bill.

 

[Anthony Jones]

These two server variables should ALWAYS return the domain name of the host:

- Request.ServerVariables("SERVER_NAME")
- Request.ServerVariables("HTTP_HOST")

Under what circumstances can those server variables return the server names of domains
that are completely unrelated to the hosting website???

I know, it's not supposed to work that way, but it is. I'm seeing almost 30,000
accesses/day on an empty website, no less!

For each entry, as a debugging mechanism I decided to log all the
Request.ServerVariables entries, and that's when I noticed the outrageous behavior of
the above two server variables.

How is this technically, possible???

(I should note that Request.ServerVariables("HTTP_REFERER") always returns the proper IP
address for the website. Also, I believe I know WHAT is causing this traffic, but to
prevent defensive answers on this group I don't want to mention that yet.)

THANKS!!!

Bill.

In the case of server variables with the HTTP_ prefix these always contain
whatever text is in the Request header with a name matching the rest of the
variable name. All HTTP requests must contain a host: header, however, I'm
not sure what IIS would do it it were left blank.

HTTP_REFERER would therefore return the content of the referer header.
Typically a browser will supply this.

If the client agent added a request header PinkElephants it's value can be
retreived using HTTP_PINKELEPHANTS.

As to the SERVER_NAME I've never found it to return anything other that
whatever HTTP_HOST does regardless of what the documentation says it does.

IOW, the 'outrageous behavior' is likely caused by one of more clients
mis-behaving and is not the fault of server.