Tricky SERVER_NAME and HTTP_HOST return values?

These two server variables should ALWAYS return the domain name of the host:

- Request.ServerVariables("SERVER_NAME")
- Request.ServerVariables("HTTP_HOST")

Under what circumstances can those server variables return the server names of domains
that are completely unrelated to the hosting website???

I know, it's not supposed to work that way, but it is. I'm seeing almost 30,000
accesses/day on an empty website, no less!

For each entry, as a debugging mechanism I decided to log all the
Request.ServerVariables entries, and that's when I noticed the outrageous behavior of
the above two server variables.

How is this technically, possible???

(I should note that Request.ServerVariables("HTTP_REFERER") always returns the proper IP
address for the website. Also, I believe I know WHAT is causing this traffic, but to
prevent defensive answers on this group I don't want to mention that yet.)

THANKS!!!

Bill.

Re: Tricky SERVER_NAME and HTTP_HOST return values?

"Bill" wrote in message
news:eNU76eNjHHA.4676@TK2MSFTNGP02.phx.gbl...
> These two server variables should ALWAYS return the domain name of the
host:
>
> - Request.ServerVariables("SERVER_NAME")
> - Request.ServerVariables("HTTP_HOST")
>
> Under what circumstances can those server variables return the server
names of domains
> that are completely unrelated to the hosting website???
>
> I know, it's not supposed to work that way, but it is. I'm seeing almost
30,000
> accesses/day on an empty website, no less!
>
> For each entry, as a debugging mechanism I decided to log all the
> Request.ServerVariables entries, and that's when I noticed the outrageous
behavior of
> the above two server variables.
>
> How is this technically, possible???
>
> (I should note that Request.ServerVariables("HTTP_REFERER") always returns
the proper IP
> address for the website. Also, I believe I know WHAT is causing this
traffic, but to
> prevent defensive answers on this group I don't want to mention that yet.)
>
> THANKS!!!
>
> Bill.

In the case of server variables with the HTTP_ prefix these always contain
whatever text is in the Request header with a name matching the rest of the
variable name. All HTTP requests must contain a host: header, however, I'm
not sure what IIS would do it it were left blank.

HTTP_REFERER would therefore return the content of the referer header.
Typically a browser will supply this.

If the client agent added a request header PinkElephants it's value can be
retreived using HTTP_PINKELEPHANTS.

As to the SERVER_NAME I've never found it to return anything other that
whatever HTTP_HOST does regardless of what the documentation says it does.

IOW, the 'outrageous behavior' is likely caused by one of more clients
mis-behaving and is not the fault of server.