I don't understand this, how can we force the browser to include host header when we enter an URL? Base on my observation, when visit some URL, host header will be included, but some are not.
A example of visiting stackoverflow like below:
I don't understand, how can we control its behavior to include host name? In case I have multiple subdomain using same IP, there is no way to differentiate which app I want to visit.
Stackoverflow uses HTTP/2, which uses the :authority header instead of host. If you scroll up on the right side you can see it.
See RFC7540 for more information:
"To ensure that the HTTP/1.1 request line can be reproduced accurately, this pseudo-header field MUST be omitted when translating from an HTTP/1.1 request that has a request target in origin or asterisk form. Clients that generate HTTP/2 requests directly SHOULD use the ":authority" pseudo-header field instead of the Host header field. An intermediary that converts an HTTP/2 request to HTTP/1.1 MUST create a Host header field if one is not present in a request by copying the value of the ":authority" pseudo-header field."
In case I have multiple subdomain using same IP, there is no way to differentiate which app I want to visit.
Stackoverflow also uses HTTPS. Web servers can route to the correct domain based on the SNI extension passed in the TLS handshake.
https://www.globalsign.com/en/blog/what-is-server-name-indication/
"On an HTTP site, a server uses HTTP HOST headers to determine which HTTP website it should present. However, when using TLS (the protocol behind HTTPS), the secure session needs to be created before the HTTP session can be established and until then, no host header is available.
...
Server Name Indication (SNI) is an extension of the TLS protocol. The client specifies which hostname they want to connect to using the SNI extension in the TLS handshake. This allows a server (for example Apache, Nginx, or a load balancer such as HAProxy) to select the corresponding private key and certificate chain that are required to establish the connection from a list or database while hosting all certificates on a single IP address."
