# Preventing requests with unknown host names

**URL:** <https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094>\
**Category:** NGINX\
**Created:** [August 20, 2015, 11:47pm UTC](https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094 "2015-08-20T23:47:43Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [August 20, 2015, 11:47pm UTC](https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094/1 "2015-08-20T23:47:43Z")

</div>

I want to disable processing of all requests that do not have a valid  
hostname

I’m tried to follow the advice on:  
[http://nginx.org/en/docs/http/request\_processing.html#how\_to\_prevent\_undefined\_server\_names](http://nginx.org/en/docs/http/request_processing.html#how_to_prevent_undefined_server_names)

so I have (inside http directive):

```
server {

    listen 80;
    server_name "";
    return 444;
}

```

I also tried

```
server {

    listen 80;
    server_name _;
    return 444;
}

```

but I am still able to access the website by its IP address?

what am I doing wrong?

–

Igal Sapir  
Lucee Core Developer  
[Lucee.org](http://Lucee.org) [http://lucee.org/](http://lucee.org/)

---

<div class="post-metadata">

**Author:** ![Igal\_S\_Lucee.org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/6f9a4e/32.png) [@Igal\_S\_Lucee.org](https://www.ruby-forum.com/u/Igal_S_Lucee.org)\
**Post date:** [August 21, 2015, 12:17am UTC](https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094/2 "2015-08-21T00:17:30Z")

</div>

On Thu, Aug 20, 2015 at 02:46:57PM -0700, Igal @ [Lucee.org](http://Lucee.org) wrote:

> I want to disable processing of all requests that do not have a valid  
> hostname

Check your entire configuration for “listen” directives.

> **[Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html#listen)**
>
> This directive appeared in version 1.11.8.

There will be zero or more in each server{} block. If there are zero,  
that is equivalent to “listen 80” (if you run as root).

For each “listen” directive with a unique ip:port, add one server{}  
block which contains “listen ip:port default\_server; return 444;”

> ```
> }
> 
> ```

If your config only has “listen 80”, or no “listen” directives at all,  
then

server {  
listen 80 default\_server;  
return 444;  
}

should do what you want.

> but I am still able to access the website by its IP address?
> 
> what am I doing wrong?

Not causing that server to be the default server for the ip:port you  
are connecting to.

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![Igal\_S\_Lucee.org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/6f9a4e/32.png) [@Igal\_S\_Lucee.org](https://www.ruby-forum.com/u/Igal_S_Lucee.org)\
**Post date:** [August 21, 2015, 12:56am UTC](https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094/3 "2015-08-21T00:56:40Z")

</div>

Thank you, Francis.

> For each “listen” directive with a unique ip:port, add one server{}  
> block which contains “listen ip:port default\_server; return 444;”  
> This seems to do the trick.

I expected there to be a way to do all of the IP addresses at once.

Thanks for your help!

Igal

---

<div class="post-metadata">

**Author:** ![Igal\_S\_Lucee.org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/6f9a4e/32.png) [@Igal\_S\_Lucee.org](https://www.ruby-forum.com/u/Igal_S_Lucee.org)\
**Post date:** [August 21, 2015, 8:37am UTC](https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094/4 "2015-08-21T08:37:05Z")

</div>

So while this worked well for port 80:

On 8/20/2015 3:55 PM, Igal @ [Lucee.org](http://Lucee.org) wrote:

> Thank you, Francis.
> 
> > For each “listen” directive with a unique ip:port, add one server{}  
> > block which contains “listen ip:port default\_server; return 444;”  
> > This seems to do the trick.

when I tried to add listen for port 443 it broke the https for requests  
with the valid hostname as well.

## disable http server for requests with unknown hosts

server {

```
listen IP:80 default_server;

```

# listen IP:443 default\_server; # breaks all https??

```
return 444;

```

}

what’s the trick to do the same for https without breaking the requests  
for [https://myhost/](https://myhost/) ?

---

<div class="post-metadata">

**Author:** ![Igal\_S\_Lucee.org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/6f9a4e/32.png) [@Igal\_S\_Lucee.org](https://www.ruby-forum.com/u/Igal_S_Lucee.org)\
**Post date:** [August 21, 2015, 9:23am UTC](https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094/5 "2015-08-21T09:23:14Z")

</div>

On Thu, Aug 20, 2015 at 03:55:51PM -0700, Igal @ [Lucee.org](http://Lucee.org) wrote:

Hi there,

> > For each “listen” directive with a unique ip:port, add one server{}  
> > block which contains “listen ip:port default\_server; return 444;”  
> > This seems to do the trick.
> 
> I expected there to be a way to do all of the IP addresses at once.

You can add all of the “listen … default\_server;” directives into a  
single server{}.

But the way nginx chooses which server{} to use to handle a request,  
means that there is not a single “listen” directive that will catch  
everything that you don’t want to go elsewhere.

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![Igal\_S\_Lucee.org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/6f9a4e/32.png) [@Igal\_S\_Lucee.org](https://www.ruby-forum.com/u/Igal_S_Lucee.org)\
**Post date:** [August 21, 2015, 9:30am UTC](https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094/6 "2015-08-21T09:30:50Z")

</div>

On Thu, Aug 20, 2015 at 11:35:58PM -0700, Igal @ [Lucee.org](http://Lucee.org) wrote:

> On 8/20/2015 3:55 PM, Igal @ [Lucee.org](http://Lucee.org) wrote:

Hi there,

I do not know the full answer to your question.

> what’s the trick to do the same for https without breaking the requests  
> for [https://myhost/](https://myhost/) ?

You will need at least a proper ssl configuration in that server{}  
block – possibly setting it at http level.

See, for example,

> **[Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html#name_based_https_servers)**
>
> To configure an HTTPS server, the ssl parameter must be enabled on listening sockets in the server block, and the locations of the server certificate and private key files should be specified:

In general, the ssl hostname that the browser wants to connect to is  
not available until after the ssl negotiation has happened.

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![Igal\_S\_Lucee.org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/6f9a4e/32.png) [@Igal\_S\_Lucee.org](https://www.ruby-forum.com/u/Igal_S_Lucee.org)\
**Post date:** [August 21, 2015, 4:26pm UTC](https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094/7 "2015-08-21T16:26:47Z")

</div>

> You will need at least a proper ssl configuration in that server{}  
> block – possibly setting it at http level.  
> that makes sense. thanks again!

Igal Sapir  
Lucee Core Developer  
[Lucee.org](http://Lucee.org) [http://lucee.org/](http://lucee.org/)

---

<div class="post-metadata">

**Author:** ![Igal\_S\_Lucee.org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/6f9a4e/32.png) [@Igal\_S\_Lucee.org](https://www.ruby-forum.com/u/Igal_S_Lucee.org)\
**Post date:** [August 21, 2015, 1:50pm UTC](https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094/8 "2015-08-21T13:50:12Z")

</div>

On 21.08.2015 10:30, Francis D. wrote:

> > server {
> 
> See, for example,

> **[Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html#name_based_https_servers)**
>
> To configure an HTTPS server, the ssl parameter must be enabled on listening sockets in the server block, and the locations of the server certificate and private key files should be specified:

> In general, the ssl hostname that the browser wants to connect to is  
> not available until after the ssl negotiation has happened.
> 
> f  
> Look at this link:  
> [Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html#sni)

SNI will help you with to have listen separate server\_name on one IP and  
have default\_server.

---

<div class="post-metadata">

**Author:** ![Igal\_S\_Lucee.org](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/6f9a4e/32.png) [@Igal\_S\_Lucee.org](https://www.ruby-forum.com/u/Igal_S_Lucee.org)\
**Post date:** [August 21, 2015, 8:14pm UTC](https://www.ruby-forum.com/t/preventing-requests-with-unknown-host-names/243094/9 "2015-08-21T20:14:02Z")

</div>

On 8/21/2015 4:49 AM, navern wrote:

> > > ## disable http server for requests with unknown hosts
> > 
> > block – possibly setting it at http level.  
> > [Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html#sni)
> 
> SNI will help you with to have listen separate server\_name on one IP  
> and have default\_server.  
> I have SNI enabled (running on Windows and confirmed by calling `$ nginx -V`

not sure how to “use” that?

thanks