Redirect to another one of my sites?

**kal**

A free cookie (or beer) to anyone who can figure this out for me:

I've had two people over the last few weeks tell me that through various actions they perform here they somehow get redirected to another one of my sites I run: www.CurtPalme.com

I can't for the life of me figure out how so I'm hoping maybe someone else noticed where this happens and can point it out. I emailed the last user who mentioned this to me but they have not responded. The email they sent does not help me figure out where the issue is either. They wrote:

crush · Joined: 28 Dec 2010 Posts: 706 Location: Telemark, Norway

Do you know what browser the person was using? As you point out, there's not a lot to go on, but if I had to guess, it'd say it was a problem with named virtual hosts.

Pinging both sites show their domains resolve to the same IP, so all requests go to the same webserver. The browser includes the name of the site when it asks for a page, by setting a header (basically a named value), e.g. "Host: www.theelectricbrewery.com". so thatyour webserver knows which site to serve. If this information is mising/getting lost somehow, then your webserver will show the "default" site for the IP.

You can achieve the same effect by browsing the IP directly, e.g. http://206.225.20.165.

To get to a fix you might try filtering your weblogs, looking for requests without a Host header (if headers are logged). Or, failing that, if you know the person's IP that was having the problem, look for requests that IP, which might shed some light on the cause of the problem. That's about all I can suggest, sorry I can't be more specific.

**kal** · Posted: Fri Feb 18, 2011 1:48 am Post subject:

Thanks Crush.

Unfortunately there's not much to go on to give me anything to filter on. What's interesting however is when surfing directly to the IP (ie: over port 80) gets me to sub-forum on my home theater site... makes sense... the virtual host is 3d-vip.curtpalme.com which is a redirect to a sub-forum. It gets picked up since it's the *first* in the list at IP 206.225.20.165.

This user was a few days ago, the other a few weeks ago so hard to search through the logs. I just found it odd. You're likely right that it has something to do with virtual hosts/headers.

You've given me some ideas to think about if I get more questions. Hopefully this one user will get back to me as to exactly what they did (I asked).

Kal

crush · Joined: 28 Dec 2010 Posts: 706 Location: Telemark, Norway

Yes, the first virtual host is used when no name match is found. See the name-based virtual hosts in the apache manual. http://httpd.apache.org/docs/current/vhosts/name-based.html. It also includes a suggestion for working with older browsers.

You might set up a jump site as your first virtual host to capture unmatched virtual host names. Just give it a bogus name, or a subdomain of one of your existing domains (e.g. jump.theelectricbrewery.com). Since this domain is not in the DNS, it will never be matched from a real request, and being the first, it matches IP-only or invalid names.

The jump site provides a jump page to your other sites, something like this:

"From your request, we're not sure which site you are interested in visiting:
- www.theelectricbrewery.com
- www.kalsothersites.com...
- etc..

The jump site would serve this page for any URL request, and as a little help to the user to get them on their way, it can fill out the links to point the page the user was trying to get, since the server knows the path the user requested.

For example, browser requests just "/index.php?somepage" without a Host header. This hits your unnamed default host. The host serves up the jump page, and while serving, it fixes up the urls like this:

"From your request, we're not sure which site you are interested in visiting:
- www.theelectricbrewery.com [href=http://www.theelectricbrewerycom/index.php?somepage]
- www.kalsothersites.com... [href=http://kalsothersite.com/index.php?somepage]
- etc..

You can set up the server to log the full request when serving this page, e.g. to a separate log. You then have a clearly identified place to look for in your server logs for virtual host problems, and the jump page helps users get to where they were looking for.

An alternative to logging all headers (if that is not easy to set up) is to add to the jump page

"If this problem continues, please email [xxx] with the information below:

[full dump of request headers]

"

If the user has a HTTP/1.0 or earlier browser without Host header support, they will not be able to view your sites. If you meet such a user, ask them where they got their time machine from!

**kal** · Posted: Fri Feb 18, 2011 2:00 pm Post subject:

Interesting ideas Crush (You obviously work in the internet tech side of things!)

So the first virtual host is barely used so I'll just monitor it for traffic out of curiousity... Now it's mostly hackers from Romania trying to get into MySQL, links from this thread, or robots/favicon requests:

crush · Joined: 28 Dec 2010 Posts: 706 Location: Telemark, Norway

Do you have any weblog analytics software installed? Looking at the raw log will make your eyes bleed!

the HTTP/1.0 entry, 5th log looks a little suspicious, but HTTP/1.0 does support the Hosts header it could be fine. Without knowing the value of hte Hosts: header for that request, we can't say.

Should you get lucky and find the actual log entry corresponding to the problem, it may not tell you much (without the Hosts header), and you will still need to decide if you want to just leave things as they are or add support for non-named hosts (using the site-per-directory arrangement outlined in the apache manual page I linked to above.)

If I were in your shoes, I'd just leave it. At the very most, you can put your most visited site (presumably this one?) as your first listed virtual host. If the virtual host mechanism then fails, there's a greater chance the user gets what they were looking for. And if not, you might just convert some unsuspecting soul to an electric brewer! Smile