Skip to content

fix: match hostname routes on non-standard ports - #10568

Open
gr8man wants to merge 2 commits into
codeigniter4:developfrom
gr8man:fix/router-hostname-port
Open

gr8man wants to merge 2 commits into
codeigniter4:developfrom
gr8man:fix/router-hostname-port

Conversation

@gr8man

@gr8man gr8man commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Description

HTTP_HOST includes the port (e.g. example.com:8080), so routes restricted
by the hostname option never matched on non-standard ports. The host is now
stripped of the port and validated (domain, IPv4, IPv6) before comparison.

Checklist:

  • Securely signed commits
  • Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
  • Unit testing, with >80% coverage
  • User guide updated
  • Conforms to style guide

- Strip port from HTTP_HOST in RouteCollection constructor
- Add test cases for hostname with port matching

Fixes issue where hostname routing fails on custom ports (e.g., example.com:8080)
because HTTP_HOST user-controlled port was not being removed during comparison.
Co-authored-by: CodeIgniter Bot
@carson-codeigniter4 carson-codeigniter4 Bot added the bug Verified issues on the current code behavior or pull requests that will fix them label Sep 18, 2026

@michalsn michalsn left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand the motivation, especially since the hostname name may suggest that the port should not be considered.

However, I'm not sure we need to change the existing behavior. Currently, the option is compared against HTTP_HOST, which allows users to include the port when necessary - for example, localhost:8080. This also preserves the ability to distinguish the same hostname on different ports.

Would you be open to changing this into a documentation-only PR? We could clarify that the match is against the request host value and that, when it contains a non-standard port, the port must also be included in the route option.

@gr8man

gr8man commented Sep 19, 2026

Copy link
Copy Markdown
Contributor Author

Thanks for the feedback! I understand the concern about backward compatibility and port-based routing.

However, requiring users to hardcode ports in routes (e.g., localhost:8080) is problematic across different environments (local Docker/spark serve vs production).

How about a backward-compatible compromise?

If the route's hostname option explicitly includes a port (e.g., 'localhost:8080'), we match it against the full host:port (preserving current behavior).

If the route's hostname does not include a port (e.g., 'example.com' or 'localhost'), we strip the port from the incoming request before comparison.

This avoids any breaking changes for existing code while making standard hostname routing work seamlessly across environments with non-standard ports.

If you still prefer not to modify the behavior in code, I can update this PR to be documentation-only as suggested.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Verified issues on the current code behavior or pull requests that will fix them

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants