`$host` is a variable of the [Core][1] module.

&gt; $host

&gt; This variable is equal to line Host in the header of request or
&gt; name of the server processing the request if the Host header is not
&gt; available.

&gt; This variable may have a different value from $http_host in such
&gt; cases: 1) when the Host input header is absent or has an empty value,
&gt; $host equals to the value of server_name directive; 2)when the value
&gt; of Host contains port number, $host doesn&#39;t include that port number.
&gt; $host&#39;s value is always lowercase since 0.8.17.

`$http_host` is also a variable of the same module but you won&#39;t find it with that name because it is defined generically as `$http_HEADER` ([ref][2]).

&gt; $http_HEADER

&gt; The value of the HTTP request header HEADER when converted to lowercase and with &#39;dashes&#39; converted to &#39;underscores&#39;, e.g. $http_user_agent, $http_referer...;


----------


Summarizing:

 - `$http_host` equals always the `HTTP_HOST` request header.
 - `$host` equals `$http_host`, **lowercase and without the port number** (if present), **except when `HTTP_HOST` is absent or is an empty value**. In that case, `$host` equals the value of the `server_name` directive of the server which processed the request.

  [1]: https://nginx.org/en/docs/http/ngx_http_core_module.html#var_host
  [2]: https://nginx.org/en/docs/http/ngx_http_core_module.html#var_http_

The accepted answer and its comments don&#39;t seem to be correct (anymore). The docs (http://nginx.org/en/docs/http/ngx_http_core_module.html#var_host) say that `$host` is 

&gt; in this order of precedence: host name from the request line, or host name from the “Host” request header field, or the server name matching a request 

So `$http_host` is always the value of the `Host` header field. They might differ if the host in the request line (if specified) differs from the `Host` header field. Or if the `Host` header is not set. 

`server_name` matches only the `Host` header field (http://nginx.org/en/docs/http/request_processing.html), so that `$host` may differ from the matched `server_name`.

I start planning a REST API with node.js ,express and mongodb. The API provides data for a website (public and private area) and maybe later a mobile app. The frontend will be developed with AngularJS.

For some days I read a lot about securing REST APIs, but I don’t get to a final solution. As far as I understand is to use HTTPS to provide a basic security. But how I can protect the API in that use cases:

- Only visitors/users of  the website/app are allowed to get data for the public area of the website/app

- Only authenticated and authorized users are allowed to get data for private area (and only data, where the user granted permissions)

At the moment I think about to only allow users with a active session to use the API. To authorize the users I will use passport and for permission I need to implement something for myself. All on the top of HTTPS.

Can somebody provide some best practice or experiences? Is there a lack in my “architecture”?


How to implement a secure REST API with node.js

I have a very boiled down version of what I am doing that gets the problem across.

I have a simple `directive`. Whenever you click an element, it adds another one. However, it needs to be compiled first in order to render it correctly.

My research led me to `$compile`. But all the examples use a complicated structure that I don&#39;t really know how to apply here.

Fiddles are here: http://jsfiddle.net/paulocoelho/fBjbP/1/

And the JS is here:

    var module = angular.module(&#39;testApp&#39;, [])
        .directive(&#39;test&#39;, function () {
        return {
            restrict: &#39;E&#39;,
            template: &#39;&lt;p&gt;{{text}}&lt;/p&gt;&#39;,
            scope: {
                text: &#39;@text&#39;
            },
            link:function(scope,element){
                $( element ).click(function(){
                    // TODO: This does not do what it&#39;s supposed to :(
                    $(this).parent().append(&quot;&lt;test text=&#39;n&#39;&gt;&lt;/test&gt;&quot;);
                });
            }
        };
    });

Solution by Josh David Miller: 
http://jsfiddle.net/paulocoelho/fBjbP/2/


How can I dynamically add a directive in AngularJS?

In Nginx, what&#39;s the difference between variables `$host` and `$http_host`.

What&#39;s the difference of $host and $http_host in Nginx

<p>In Nginx, what's the difference between variables <code>$host</code> and <code>$http_host</code>.</p>


I&#39;d like to set some defaults for mocha without having to type them each time. Does mocha look for a config file / dotfile anywhere, as jshint looks for `.jshintrc` and npm looks for `package.json`?

Is there a .mocha file where I can specify defaults such as --no-colors?

I am setting up my first `Node.js` server on a `cloud Linux node` and I am fairly new to the details of `Linux admin`. (BTW I am not trying to use Apache at the same time.) 

Everything is installed correctly, but I found that unless I use the `root login`, I am not able to listen on `port 80` with node. However I would rather not run it as root for security reason. 

What is the best practice to:

1. Set good permissions / user for node so that it is secure / sandboxed?
2. Allow port 80 to be used within these constraints.
3. Start up node and run it automatically.
4. Handle log information sent to console.
5. Any other general maintenance and security concerns.

Should I be forwarding port 80 traffic to a different listening port?

Thanks



Best practices when running Node.js with port 80 (Ubuntu / Linode)

My question is a little bit common, but it is linked with Gradle too.

**Why we need compile and runtime configuration?**

When I compile something I need artifacts to convert my java classes in bytecode so I need compile configuration, but why is needed runtime configuration do I need something else to run my application in JVM?

Sorry if it sounds stupid, but I don&#39;t understand.

Difference between compile and runtime configurations in Gradle

Where does the name &#39;default&#39; come from when launching a vagrant box?

    $ vagrant up
    Bringing machine &#39;default&#39; up with &#39;virtualbox&#39; provider...

Is there a way to set this?

How to change Vagrant &#39;default&#39; machine name?

I have a Node.js/Express.js app running on my server that only works on port 3000 and I&#39;m trying to figure out why. Here&#39;s what I&#39;ve found:

 - Without specifying a port (`app.listen()`), the app runs but the web page does not load.
 - On port 3001 (`app.listen(3001)`) or any other port that is not in use, the app runs but the web page does not load. 
 - On port 2999, the app throws an error because something else is using that port.
 - On port 3000, the app runs and the web page loads fine.

I know that Express apps default to port 3000. But strangely, my app only runs when I explicitly make it run on port 3000 (`app.listen(3000)`).

I found this on line 220 of `/usr/bin/express`:

    app.set(\&#39;port\&#39;, process.env.PORT || 3000);

Which is doing as previously stated: setting the port to what is specified or to 3000 if nothing is specified.

How could I make my app work on a different port such as 8080 or 3001?

Thanks!

**Edit: Code Sample (Very Simple Node/Express App)**

    var express = require(&quot;express&quot;);
    var app = express();

    app.get(&#39;/&#39;, function(req, res){
    	res.send(&#39;hello world&#39;); 
    });

    // Only works on 3000 regardless of what I set environment port to or how I set [value] in app.set(&#39;port&#39;, [value]).
    app.listen(3000);

Node.js/Express.js App Only Works on Port 3000

In Nginx, I&#39;m trying to define a variable which allows me to configure a sub-folder for all my location blocks. I did this:

    set $folder &#39;/test&#39;;

    location $folder/ {
       [...]
    }

    location $folder/something {
       [...]
    }

Unfortunately, this doesn&#39;t seem to work. While Nginx doesn&#39;t complain about the syntax, it returns a 404 when requesting `/test/`. If I write the folder in explicitly, it works. So how can I use variables in location blocks?

Using variables in Nginx location rules

I have setup an nginx server with php5-fpm.  When I try to load the site I get a blank page with no errors.  Html pages are served fine but not php.  I tried turning on display_errors  in php.ini but no luck.  php5-fpm.log is not producing any errors and neither is nginx.

**nginx.conf**

    server {
        listen 80;
        root /home/mike/www/606club;
        index index.php index.html;
        server_name mikeglaz.com www.mikeglaz.com;
        error_log /var/log/nginx/error.log;
        location ~ \.php$ {
                #fastcgi_pass 127.0.0.1:9000;
                # With php5-fpm:
                fastcgi_pass unix:/var/run/php5-fpm.sock;
                fastcgi_index index.php;
                include fastcgi_params;
        }
    }

**EDIT**

here&#39;s my nginx error log:

    2013/03/15 03:52:55 [error] 1020#0: *55 open() &quot;/home/mike/www/606club/robots.txt&quot; failed (2: No such file or directory), client: 199.30.20.40, server: mikeglaz.com, request: &quot;GET /robots.txt HTTP/1.1&quot;, host: &quot;mikeglaz.com&quot;

nginx showing blank PHP pages

I&#39;m running nginx in a Virtual Machine using NAT and I&#39;m having redirection issues when I access it from the host machine.

### Works as expected
- `http://localhost:8080/test/index.htm`: works.
- `http://localhost:8080/test/`: works.

### Doesn&#39;t work as expected
- `http://localhost:8080/test`: redirects to `http://localhost/test/` . This is ***not*** what I want. **(notice it strips the port number)**

### What I&#39;ve tried

Based on what I&#39;ve googled, I tried `server_name_in_redirect off;` and `rewrite ^([^.]*[^/])$ $1/ permanent;`, both with no success.


### My default.conf:

    server {
        listen       80;
        server_name  localhost;
        # server_name_in_redirect off;
        
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm index.php;
        }
    
        location ~ \.php$ {
    	# rewrite ^([^.]*[^/])$ $1/ permanent;
            root           /usr/share/nginx/html;
            try_files      $uri =404;
            #fastcgi_pass   127.0.0.1:9000;
            fastcgi_pass   unix:/tmp/php5-fpm.sock;
            fastcgi_index  index.php;
            include        fastcgi_params;
        }
    
    
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }

    }



Nginx causes 301 redirect if there&#39;s no trailing slash

At the end of last week I noticed a problem on one of my medium AWS instances where Nginx always returns a HTTP 499 response if a request takes more than 60 seconds.  The page being requested is a PHP script

I&#39;ve spent several days trying to find answers and have tried everything that I can find on the internet including several entries here on Stack Overflow, nothing works.

I&#39;ve tried modifying the PHP settings, PHP-FPM settings and Nginx settings. You can see a question I raised on the NginX forums on Friday (http://forum.nginx.org/read.php?9,237692) though that has received no response so I am hoping that I might be able to find an answer here before I am forced to moved back to Apache which I know just works.

This **is not** the same problem as the HTTP 500 errors reported in other entries.

I&#39;ve been able to replicate the problem with a fresh micro AWS instance of NginX using PHP 5.4.11.

To help anyone who wishes to see the problem in action I&#39;m going to take you through the set-up I ran for the latest Micro test server.

You&#39;ll need to launch a new AWS Micro instance (so it&#39;s free) using the AMI ami-c1aaabb5

This PasteBin entry has the complete set-up to run to mirror my test environment. You&#39;ll just need to change *example.com* within the NginX config at the end

http://pastebin.com/WQX4AqEU

Once that&#39;s set-up you just need to create the sample PHP file which I am testing with which is


    &lt;?php
    sleep(70);
    die( &#39;Hello World&#39; );
    ?&gt;

Save that into the webroot and then test.  If you run the script from the command line using php or php-cgi, it will work.  If you access the script via a webpage and tail the access log */var/log/nginx/example.access.log*, you will notice that you receive the HTTP 1.1 499 response after 60 seconds.

Now that you can see the timeout, I&#39;ll go through some of the config changes I&#39;ve made to both PHP and NginX to try to get around this.  For PHP I&#39;ll create several config files so that they can be easily disabled

**Update the PHP FPM Config to include external config files**

    sudo echo &#39;
    include=/usr/local/php/php-fpm.d/*.conf
    &#39; &gt;&gt; /usr/local/php/etc/php-fpm.conf

**Create  a new PHP-FPM config to override the request timeout**

    sudo echo &#39;[www]
    request_terminate_timeout = 120s
    request_slowlog_timeout = 60s
    slowlog = /var/log/php-fpm-slow.log &#39; &gt;
    /usr/local/php/php-fpm.d/timeouts.conf

**Change some of the global settings to ensure the emergency restart interval is 2 minutes**

    # Create a global tweaks
    sudo echo &#39;[global]
    error_log = /var/log/php-fpm.log
    emergency_restart_threshold = 10
    emergency_restart_interval = 2m
    process_control_timeout = 10s
    &#39; &gt; /usr/local/php/php-fpm.d/global-tweaks.conf

Next, we will change some of the PHP.INI settings, again using separate files

    # Log PHP Errors
    sudo echo &#39;[PHP]
    log_errors = on
    error_log = /var/log/php.log
    &#39; &gt; /usr/local/php/conf.d/errors.ini

    sudo echo &#39;[PHP]
    post_max_size=32M
    upload_max_filesize=32M
    max_execution_time = 360
    default_socket_timeout = 360
    mysql.connect_timeout = 360
    max_input_time = 360
    &#39; &gt; /usr/local/php/conf.d/filesize.ini

As you can see, this is increasing the socket timeout to 3 minutes and will help log errors.

Finally, I&#39;ll edit some of the NginX settings to increase the timeout&#39;s that side

First I edit the file */etc/nginx/nginx.conf* and add this to the http directive
    fastcgi_read_timeout 300;

Next, I edit the file */etc/nginx/sites-enabled/example* which we created earlier (See the pastebin entry) and add the following settings into the **server** directive

    client_max_body_size    200;
    client_header_timeout   360;
    client_body_timeout     360;
    fastcgi_read_timeout    360;
    keepalive_timeout       360;
    proxy_ignore_client_abort on;
    send_timeout            360;
    lingering_timeout       360;

Finally I add the following into the *location ~ \.php$* section of the server dir

	fastcgi_read_timeout 360;
	fastcgi_send_timeout 360;
	fastcgi_connect_timeout 1200;

Before retrying the script, start both nginx and php-fpm to ensure that the new settings have been picked up. I then try accessing the page and still receive the HTTP/1.1 499 entry within the NginX example.error.log.

So, where am I going wrong?  This just works on apache when I set PHP&#39;s max execution time to 2 minutes.

I can see that the PHP settings have been picked up by running **phpinfo()** from a web-accessible page.  I just don&#39;t get, I actually think that too much has been increased as it should just need PHP&#39;s *max_execution_time*, *default_socket_timeout* changed as well as NginX&#39;s *fastcgi_read_timeout* within just the server-&gt;location directive.

##Update 1##

Having performed some further test to show that the problem is not that the client is dying I have modified the test file to be

    &lt;?php
    file_put_contents(&#39;/www/log.log&#39;, &#39;My first data&#39;);
    sleep(70);
    file_put_contents(&#39;/www/log.log&#39;,&#39;The sleep has passed&#39;);
    die(&#39;Hello World after sleep&#39;);
    ?&gt;

If I run the script from a web page then I can see the content of the file be set to the first string. 60 seconds later the error appears in the NginX log. 10 seconds later the  contents of the file changes to the 2nd string, proving that PHP is completing the process.

##Update 2##
Setting **fastcgi_ignore_client_abort on;** does change the response from a HTTP 499 to a HTTP 200 though nothing is still returned to the end client.

##Update 3##
Having installed Apache and PHP (5.3.10) onto the box straight (using apt) and then increasing the execution time the problem does appear to also happen on Apache as well.  The symptoms are the same as NginX now, a HTTP200 response but the actual client connection times out before hand.

I&#39;ve also started to notice, in the NginX logs, that if I test using Firefox, it makes a double request (like this https://stackoverflow.com/questions/13261327/php-script-executes-twice-when-longer-than-60-seconds). Though that does appear to be the client requesting upon the script failing


NginX issues HTTP 499 error after 60 seconds despite config. (PHP and AWS)

In a previous [question][1] I found out that I should be setting nginx ssl termination and not having Rails process encrypted data.

Then why does the following exist?

    config.force_ssl = true

I see this commented out in the production config file. But if the expectation is that nginx will handle all the ssl stuff so that my rails app doesn&#39;t deal with encrypted data then what does `config.force_ssl = true` do?

Should I leave it commented out in production if I know I will always be using nginx?

  [1]: https://stackoverflow.com/questions/15673328/how-does-nginx-pass-ssl-encrypted-data-to-a-rails-app

What does force_ssl do in Rails?

I am a novice to angular.js, and I am trying to add some headers to a request:

       var config = {headers: {
                &#39;Authorization&#39;: &#39;Basic d2VudHdvcnRobWFuOkNoYW5nZV9tZQ==&#39;,
                &#39;Accept&#39;: &#39;application/json;odata=verbose&#39;
            }
        };

       $http.get(&#39;https://www.example.com/ApplicationData.svc/Malls(1)/Retailers&#39;, config).success(successCallback).error(errorCallback);

I&#39;ve looked at all the documentation, and this seems to me like it should be correct.

When I use a local file for the URL in the `$http.get`, I see the following HTTP request on the network tab in Chrome:

    GET /app/data/offers.json HTTP/1.1
    Host: www.example.com
    Connection: keep-alive
    Cache-Control: max-age=0
    If-None-Match: &quot;0f0abc9026855b5938797878a03e6889&quot;
    Authorization: Basic Y2hhZHN0b25lbWFuOkNoYW5nZV9tZQ==
    Accept: application/json;odata=verbose
    X-Requested-With: XMLHttpRequest
    If-Modified-Since: Sun, 24 Mar 2013 15:58:55 GMT
    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.172 Safari/537.22
    X-Testing: Testing
    Referer: http://www.example.com/app/index.html
    Accept-Encoding: gzip,deflate,sdch
    Accept-Language: en-US,en;q=0.8
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

As you can see, both of the headers were added correctly. But when I change the URL to the one shown in the `$http.get` above (except using the real address, not example.com), then I get:

    OPTIONS /ApplicationData.svc/Malls(1) HTTP/1.1
    Host: www.datahost.net
    Connection: keep-alive
    Access-Control-Request-Method: GET
    Origin: http://mpon.site44.com
    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.172 Safari/537.22
    Access-Control-Request-Headers: accept, origin, x-requested-with, authorization, x-testing
    Accept: */*
    Referer: http://mpon.site44.com/app/index.html
    Accept-Encoding: gzip,deflate,sdch
    Accept-Language: en-US,en;q=0.8
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

The only difference in code between these two is one is for the first the URL is a local file, and for the second the URL is a remote server. If you look at the second Request header, there is no Authentication header, and the `Accept` appears to be using a default instead of the one specified. Also, the first line now says `OPTIONS` instead of `GET` (although `Access-Control-Request-Method` is `GET`).

Any idea what is wrong with the above code, or how to get the additional headers included using when not using a local file as a data source?

Adding a custom header to HTTP request using angular.js

I&#39;m building an analytic tool and I can currently get the user&#39;s IP address, browser and operating system from their user agent.

I&#39;m wondering if there is a possibility to detect the same user without using cookies or local storage? I&#39;m not expecting code examples here; just a simple hint of where to look further.

Forgot to mention that it would need to be cross-browser compatible if it&#39;s the same computer/device. Basically I&#39;m after device recognition not really the user.

User recognition without cookies or local storage

Is the `Content-Length` header required for a HTTP/1.0 response? The HTTP spec mentions that it is required for the request, but doesn&#39;t mention anything about the response:

http://www.w3.org/Protocols/HTTP/1.0/draft-ietf-http-spec.html#Content-Length

&gt; A valid Content-Length field value is required on all HTTP/1.0
&gt; request messages containing an entity body.

If it is not required for the response, how does the client read the response when it&#39;s larger than 1MB?


Is the Content-Length header required for a HTTP/1.0 response?

I have a back-end server written in asp.net mvc using Forms Authentication. When the user is not authenticated, the server will automatically send a 302 redirect to a Login action and return a Login page.

On client side, I have a list of items. This list is only accessible to authenticated users. On the page, I have a button to Refresh the list using Ajax ($.ajax function of jQuery). 

Now, my problem is when the authentication ticket is timeout and the user clicks on the Refresh button:

- My function sends an ajax request to get the refreshed list
- The server detects that the authentication ticket is not valid and issues a 302 redirect.
- The browser **automatically** handles that 302 response and forces my ajax function to send another ajax request to the Login action and the final result is an HTML with status 200. My script is confused because the list is also an HTML with status 200.

What I want is when the authentication ticket is timeout and the user clicks on the Refresh button, I should be able to detect that and display a message asking the user to Login. 

I tried to workaround this by adding a custom header (IS_LOGIN) in the Login action and check that in my ajax response. But it is not a good solution.

So my questions are:

- What is the best way to deal with this problem?
- Why does the browser not let our script handle 302 response? and just automatically forces our ajax to create another request. This is a problem with the browser or jquery library? Any reasons for this? (security,...) 

Thanks for any replies.

Cannot handle 302 redirect in ajax and why?

I&#39;m looking to add custom http headers to a Ruby on Rails app that is currently hosted on Heroku.

Content Type	Original Author	Original Content on Stackoverflow
Question	glarrain	View Question on Stackoverflow
Solution 1 - Configuration	glarrain	View Answer on Stackoverflow
Solution 2 - Configuration	Christian	View Answer on Stackoverflow

What's the difference of $host and $http_host in Nginx

Configuration Problem Overview

Configuration Solutions

Solution 1 - Configuration

Solution 2 - Configuration

How can I dynamically add a directive in AngularJS?

How to implement a secure REST API with node.js

Attributions