{"record":{"id":"18c309e017f234c3","repo":"phalcon/cphalcon","slug":"invalid-host-host","errorCode":null,"errorMessage":"Invalid host {host}","messagePattern":"Invalid host (.+?)","errorType":"exception","errorClass":"Phalcon\\Http\\Request\\Exceptions\\InvalidHost","httpStatus":null,"severity":"error","filePath":"phalcon/Http/Request.zep","lineNumber":624,"sourceCode":"        if host && strict {\n            /**\n             * Cleanup. Force lowercase as per RFC 952/2181\n             */\n            let cleanHost = strtolower(\n                trim(host)\n            );\n\n            if memstr(cleanHost, \":\") {\n                let cleanHost = preg_replace(\"/:[[:digit:]]+$/\", \"\", cleanHost);\n            }\n\n            /**\n             * Host may contain only the ASCII letters 'a' through 'z'\n             * (in a case-insensitive manner), the digits '0' through '9', and\n             * the hyphen ('-') as per RFC 952/2181\n             */\n            if unlikely (\"\" !== preg_replace(\"/[a-z0-9-]+\\.?/\", \"\", cleanHost)) {\n                throw new InvalidHost(host);\n            }\n        } else {\n            let cleanHost = host;\n        }\n\n        return (string) cleanHost;\n    }\n\n    /**\n     * Return the HTTP method parameter override flag\n     *\n     * @return bool\n     */\n    public function getHttpMethodParameterOverride() -> bool\n    {\n        return this->methodOverride;\n    }\n","sourceCodeStart":606,"sourceCodeEnd":642,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Http/Request.zep#L606-L642","documentation":"Request::getHttpHost() with strict host checking enabled (setStrictHostCheck(true)) validates the resolved host (HTTP_HOST, then SERVER_NAME, then SERVER_ADDR) against RFC 952/2181: after lowercasing, trimming and stripping a trailing ':port', it may contain only a-z, 0-9, hyphen and dots. Any other character (underscore, IPv6 brackets, unicode) throws InvalidHost.","triggerScenarios":"$request->setStrictHostCheck(true) followed by $request->getHttpHost() when the Host header is 'my_service.local' (underscore), '[::1]:8080' (IPv6 literal), or an internationalized domain name.","commonSituations":"Kubernetes/Docker service names containing underscores; IPv6 literals forwarded by proxies; scanners sending malformed Host headers; hardened apps that enable strict checks behind a load balancer passing unusual Host values.","solutions":["Fix the Host header at origin: rename underscore hostnames, configure web server server_name / proxy_set_header Host with RFC-valid names","Normalize or whitelist the host in the front controller before strict consumers read it","Disable strict mode when legitimate non-RFC hosts must pass: $request->setStrictHostCheck(false)","Catch Phalcon\\Http\\Request\\Exceptions\\InvalidHost and answer 400 Bad Request"],"exampleFix":"// before\n$request->setStrictHostCheck(true);\n$host = $request->getHttpHost(); // throws on 'my_service.local'\n\n// after\n$raw = strtolower(trim((string) $request->getServer('HTTP_HOST')));\n$host = preg_replace('/:[0-9]+$/', '', $raw);\nif (!preg_match('/^[a-z0-9.-]+\\.?$/', $host)) {\n    $host = 'www.example.com'; // fallback to canonical host\n}","handlingStrategy":"validation","validationCode":"$raw = strtolower(trim((string) $request->getServer('HTTP_HOST')));\n$host = preg_replace('/:[0-9]+$/', '', $raw);\nif (!preg_match('/^[a-z0-9.-]+\\.?$/', $host)) {\n    $host = 'www.example.com'; // or reject with 400\n}\n// safe to call $request->getHttpHost() with strict checks, or use $host directly","typeGuard":null,"tryCatchPattern":"try { $host = $request->getHttpHost(); } catch (\\Phalcon\\Http\\Request\\Exceptions\\InvalidHost $e) { http_response_code(400); exit('Invalid Host header'); }","preventionTips":["Avoid underscores in internal hostnames (RFC 952 allows only letters, digits, hyphen)","Behind proxies, set proxy_set_header Host to a clean RFC-valid value","Enable strict host check only with a known-good inventory of accepted hosts"],"tags":["php","phalcon","http","host-header","validation"],"backgroundTag":"invalid-host-header","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}