# Request.host, proxy chains and HTTP\_X\_FORWARDED\_HOST

**URL:** <https://www.ruby-forum.com/t/request-host-proxy-chains-and-http-x-forwarded-host/171034>\
**Category:** Rails\
**Created:** [June 25, 2009, 4:25pm UTC](https://www.ruby-forum.com/t/request-host-proxy-chains-and-http-x-forwarded-host/171034 "2009-06-25T16:25:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![delboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/53a042/32.png) [@delboy](https://www.ruby-forum.com/u/delboy)\
**Post date:** [June 25, 2009, 4:25pm UTC](https://www.ruby-forum.com/t/request-host-proxy-chains-and-http-x-forwarded-host/171034/1 "2009-06-25T16:25:52Z")

</div>

Hi,

We’ve an application that uses url\_for in controllers and views. In  
views, url\_for generates a relative url (as if :only\_path where used).  
All is fine there.

However, in controllers, url\_for generates a full url, with the host  
name. This causes problems when we have a chain of Apache proxy  
servers:

My Browser —\> Proxy 1 ----\> Proxy 2 ----\> Phusion Deployment Server.

In this scenario, the request header item HTTP\_X\_FORWARDED\_HOST  
contains the following:

proxy1:81, proxy2

Rails extracts the host by splitting this string and getting the last  
item:

(actionpack-2.3.2\lib\action\_controller\request.rb line 271)

```
def raw_host_with_port
  if forwarded = env["HTTP_X_FORWARDED_HOST"]
    forwarded.split(/,\s?/).last
  else
    env['HTTP_HOST'] || "#{env['SERVER_NAME'] || env

```

[‘SERVER\_ADDR’]}:#{env[‘SERVER\_PORT’]}"  
end  
end

What happens is that we get proxy2 as the host.

Shouldn’t it be trying to get the first item instead -

```
    forwarded.split(/,\s?/).first

```

giving us proxy1:81 instead?

Is this a bug? If not, is there reasoning behind this?

Derek.

---

<div class="post-metadata">

**Author:** ![delboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/53a042/32.png) [@delboy](https://www.ruby-forum.com/u/delboy)\
**Post date:** [June 25, 2009, 4:37pm UTC](https://www.ruby-forum.com/t/request-host-proxy-chains-and-http-x-forwarded-host/171034/2 "2009-06-25T16:37:02Z")

</div>

Actually, I’ve just seen the following in the Django mailing lists:

[http://www.mail-archive.com/removed\_email\_address@domain.invalid/msg33992.html](http://www.mail-archive.com/removed_email_address@domain.invalid/msg33992.html)

Looks like the option to select the last item is deliberate.