Listen to localhost, handle request with arbitrary Host headers

[MrDigit]

Hello,

I want that embedio bind to localhost interface, (URL prefix: http://localhost:12345) but it should handle all incoming requests, independent of the host header.

Currently, if the host header is not localhost (i.e. 127.0.0.1 or something different) it doesn't handle the request.

Is this feature, a bug, my fault ?

Best regards
MrDigit

[geoperez]

This is not a bug, this is how Httpsys works. If you change your binding to http://+:12345 you can connect using localhost or 127.0.0.1.

Some useful links:

https://www.codeproject.com/Articles/437733/Demystify-http-sys-with-HttpSysManager
https://msdn.microsoft.com/en-us/library/windows/desktop/aa364698(v=vs.85).aspx

[MrDigit]

Strong binding with "+" understood, But when using "http://+:12345" the webserver binds to 0.0.0.0.

My goal: bind to localhost, serve all requests.
Any hints to to achieve this ?

[geoperez]

Yeah, because 0.0.0.0 is a placeholder to say anything is valid.

I'm not understanding, why don't you use '+' or '*'? Is it because of permissions?

[MrDigit]

For security reasons embedio should listen only on internal loop interface but should handle requests independently of the Host-Header (another process forwards external HTTP requests to embedio that listens on localhost):

What I tried:

1. If I use http://+:12345 or * it listens to 0.0.0.0 and it handles all requests as wanted, not 100% what I want as I want it to listen only on loopback.
2. If I use http://localhost:12345 it listens to loopback as wanted but handles only requests which have "localhost" in the Host-Header field.

Is there a simple solution for what I want ?

[geoperez]

You can add both loopback in the WebServer constructor:

var server = new WebServer(new [] { "http://localhost:8787/", "http://127.0.0.1:8787/" });

[willks]

Yeah, because 0.0.0.0 is a placeholder to say anything is valid.

I'm not understanding, why don't you use '+' or '*'? Is it because of permissions?

2+ years later, I am deploying EmbedIO into docker for a health check for a console C# dotnetcore app. I had issues with binding to http://0.0.0.0:, but once I set my config to use http://*: - my app finally started working with Kubernetes. Yes, 2 years late but I only started with the dotnet world 2 weeks ago.

Good framework really! Very light (bah, lite) framework. Hardly added anything to my Docker image