Hacker News Reader

Comment by pilif | Hacker News Reader

The fact that the two IIS based sites (Microsoft, Stack overflow) both fail with an outright error 400 complaining about a bad host name makes me wonder whether this might actually be a bug in IIS to overzealously validate the hostname.

The trailing dot is totally valid and there's no need to complain.

View on HN

The 400 error is just the web server complaining that there is no web site to deliver to you for that hostname. It isn't complaining about the hostname being invalid, per se.

I thought so too, but then I made a little experiment:

    pilif@shion:~$ curl -I -H "Host: example.com"  http://198.252.206.16/
    HTTP/1.1 404 Not Found
    Content-Length: 4129
    Date: Sat, 16 Mar 2013 12:28:22 GMT

vs.

    pilif@shion:~$ curl -I -H "Host: example.com." http://198.252.206.16/
    HTTP/1.1 400 Bad Request
    Content-Length: 334
    Content-Type: text/html; charset=us-ascii
    Date: Sat, 16 Mar 2013 12:28:56 GMT

The IP is the one from stackoverflow.com. When querying for a host they are not configured (try any), you will get a 404 plus an explanation page that the selected Q&A community doesn't exist.

When you try the same host with a trailing dot, you get a generic IIS error 400.

This is too much of a coincidence and I value it as a strong sign that my hypothesis might be correct. I have no IIS at my disposal to replicate paulbeattie's experiment, but the outcome he described further helps confirming my suspicion (no matter the downvotes he got)

Same experiment works with microsoft.com too:

    pilif@shion:~$ curl -I -H "Host: example.com." http://65.55.57.27/
    HTTP/1.1 400 Bad Request
    Content-Length: 334
    Content-Type: text/html; charset=us-ascii
    Server: Microsoft-HTTPAPI/2.0
    Date: Sat, 16 Mar 2013 12:35:10 GMT
    Connection: close

    pilif@shion:~$ curl -I -H "Host: example.com" http://65.55.57.27/
    HTTP/1.1 200 OK
    Cache-Control: private
    Content-Length: 0
    Server: Microsoft-IIS/8.0
    (snip)

That's odd, I would have thought that '404 Not Found' would be the wrong response to send, although you could argue either way.

I used to develop a web server ages ago (Zeus Web Server), it would try and match the Host: header against all the sites it was configured to server, and if none matched, it would send a 400 error back.

(Incidentally, it would happily strip off the trailing dot from the hostname)

> whether this might actually be a bug in IIS to overzealously validate the hostname.

Our two websites both redirect to the version without the dot, both running on IIS6 so it can indeed handle it.

I think you might be right. I just tried it on an IIS server set to accept any hostname at the IP the site is bound to and it returned a 400 error as well. Removing the trailing dot made it work.

Stack overflow uses IIS??

Yes, I believe it was built using the .NET framework.

Built on asp.net MVC http://blog.stackoverflow.com/2008/09/what-was-stack-overflo...

Yes and it really showed in the beginning: they had lots of issues and you could constantly see the cat saying "sorry, i am wurkin' on fixin' yer problem" (don't remember the exact msg but it was a lolzcat message).

SO is also hardly something impressive from a UI point of view: it is a very simple UI really not doing much. Usenet readers from 20 years ago were way more capable than SO...

What does IIS have to do with the UI, exactly? It's just a web server.

The site's UI is simple and yet the server still can't handle it perhaps was the implication.

I'm not seeing a direct connection between UI simplicity and server capability. I can serve a hideously complex UI with a very minimal demand on the server. Demand on the server is much more about actual traffic, not the UI being rendered in the browser.

Other sites built with IIS & MVC - http://stackoverflow.com/a/12006474/10941

monster.com, break.com, ancestry.com, wildtangent.com, kbb.com, redbox.com , nordstrom.com , townhall.com, tunein.com, g4tv.com

Don't blame the framework, blame the developers.

Reply on news.ycombinator.com