From cee6646c6303ddb4166e621aa46485090d890623 Mon Sep 17 00:00:00 2001 From: Bernd Eidenschink Date: Thu, 11 May 2017 16:07:28 +0200 Subject: [PATCH] Fix typo "$host" holds the described value, not "$http" --- docs/en/plugins/hostspoofing.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/en/plugins/hostspoofing.md b/docs/en/plugins/hostspoofing.md index 1447f0b..a751ae3 100644 --- a/docs/en/plugins/hostspoofing.md +++ b/docs/en/plugins/hostspoofing.md @@ -10,7 +10,7 @@ Spoofing of this header, may leads to a variety of problems, from phishing to SS Most of the time it's a result of using `$http_host` variable instead of `$host`. And they are quite different: - * `$http` - host in this order of precedence: host name from the request line, or host name from the “Host” request header field, or the server name matching a request; + * `$host` - host in this order of precedence: host name from the request line, or host name from the “Host” request header field, or the server name matching a request; * `$http_host` - "Host" request header. Config sample: @@ -29,4 +29,4 @@ Luckily, all is quite obvious: ## Additional info * [Host of Troubles Vulnerabilities](https://hostoftroubles.com/) - * [Practical HTTP Host header attacks](http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html) \ No newline at end of file + * [Practical HTTP Host header attacks](http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html)