Host
The Host
header specifies the authority component of the request-URI.
Preface
In the olden days, the Web was a much simpler place. An HTTP server was assumed to serve a single set of documents, and that's as good a job it could be expected to do. However, this effectively prevented people from pointing their domain name to a server already hosting a website, and so caused growth problems. This was formalized as developments in networked application design specified that the URL is a subset of the URI, and names things in general, without necessarially pointing to a network location, so that servers should be able to respond to requests for any resource under an authority routed to them.
And so the Host header was introduced to HTTP, which more or less provides enough information to reconstruct the full Request-URI that the client is looking for. It is a required request header.
Making Requests
The Host header is required, even if it would be redundant or the receiving end is known to not support the header. The value must be a valid hostname and optional port, and match the hostname part of the authority of the Request-URI; or left blank if the URI has no authority component (the part after the leading "//").
Since the value is used to construct the Request-URI and is used for routing, it should be placed as the first header (closest to the Request-Line of the HTTP request), for example:
GET /pub/WWW/ HTTP/1.1
Host: www.example.org
Parsing Requests
If a request lacks or has more than one Host header, it MUST generate a 400 Bad Request
response.
The Host header is used to construct the effective Request-URI. This is described in Effective Request URI.
Overview table
- Name
- Host
- Description
- Specifies the authority component of the request-URI.
- Direction
- Request
- Specification
- RFC 7230: HTTP/1.1: Message Syntax and Routing ยง5.4. Host
Syntax
Host = uri-host [ ":" port ]
Implementations
Node.js (http/https)
Node.js automatically ignores repeated Host headers. If strict HTTP compliance is required, it may be necessary to scan the request.rawHeaders
data.