<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 10/7/24 9:48 PM, Paul B. Henson
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:PH0PR01MB752390ED3166CC286A09FD6AD27E2@PH0PR01MB7523.prod.exchangelabs.com"><br>
<pre class="moz-quote-pre" wrap="">
It seems some client is indeed providing the wrong host header 8-/.</pre>
</blockquote>
<p><br>
</p>
<p>Ok, thanks for confirming which of the 2 completely implausible
scenarios is actually happening. :-)<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:PH0PR01MB752390ED3166CC286A09FD6AD27E2@PH0PR01MB7523.prod.exchangelabs.com"><br>
<pre class="moz-quote-pre" wrap="">Interestingly, all of these failures since I enabled the extra logging come from a single IP address, 20.77.36.136, which is part of the Microsoft Azure cloud public address space...</pre>
</blockquote>
<p><br>
</p>
<p>Hmm, the front-channel request should be coming from a browser. I
guess it could be some browser client being NATed from within that
cloud env. Or maybe it's something weirder.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:PH0PR01MB752390ED3166CC286A09FD6AD27E2@PH0PR01MB7523.prod.exchangelabs.com">
<pre class="moz-quote-pre" wrap="">
Dunno. In the end I think somebody somewhere is doing something stupid, but it has nothing to do with jetty or the idp.</pre>
</blockquote>
<p><br>
</p>
<p>Almost certainly it's something stupid, or some unusual
ill-conceived testing setup that someone forgot to undo.</p>
<p>If you do ever figure the who/how/why of what is going on, I'd be
interested to know. This is definitely one of the weirder problem
reports I can remember.</p>
<p>But yeah, nothing wrong with your deployment or the IdP code. In
fact, it's doing what it should, which is rejecting an invalid
request.<br>
</p>
<p><br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:PH0PR01MB752390ED3166CC286A09FD6AD27E2@PH0PR01MB7523.prod.exchangelabs.com">
<pre class="moz-quote-pre" wrap="">
I guess I could set it up to reject invalid host headers, although various health checks and load balancer stuff talk to it using the IP address instead of the DNS name so I'd have to include those as well <sigh>.
</pre>
</blockquote>
<p><br>
</p>
<p>Fwiw, I always setup my web servers to send requests with a Host
header containing an unknown/unconfigured domain to a default
vhost which displays an appropriate error to the user about either
DNS or server misconfiguration. That prevents it from rendering
content from whatever vhost it would otherwise pick, which is both
confusing to the user and possibly insecure. That's in httpd. I
don't know how to do in Jetty, but I imagine there's a way.</p>
<p><br>
</p>
</body>
</html>