Conversation
- Strip port from HTTP_HOST in RouteCollection constructor - Add test cases for hostname with port matching Fixes issue where hostname routing fails on custom ports (e.g., example.com:8080) because HTTP_HOST user-controlled port was not being removed during comparison. Co-authored-by: CodeIgniter Bot
michalsn
left a comment
There was a problem hiding this comment.
I understand the motivation, especially since the hostname name may suggest that the port should not be considered.
However, I'm not sure we need to change the existing behavior. Currently, the option is compared against HTTP_HOST, which allows users to include the port when necessary - for example, localhost:8080. This also preserves the ability to distinguish the same hostname on different ports.
Would you be open to changing this into a documentation-only PR? We could clarify that the match is against the request host value and that, when it contains a non-standard port, the port must also be included in the route option.
|
Thanks for the feedback! I understand the concern about backward compatibility and port-based routing. However, requiring users to hardcode ports in routes (e.g., localhost:8080) is problematic across different environments (local Docker/spark serve vs production). How about a backward-compatible compromise? If the route's hostname option explicitly includes a port (e.g., 'localhost:8080'), we match it against the full host:port (preserving current behavior). If the route's hostname does not include a port (e.g., 'example.com' or 'localhost'), we strip the port from the incoming request before comparison. This avoids any breaking changes for existing code while making standard hostname routing work seamlessly across environments with non-standard ports. If you still prefer not to modify the behavior in code, I can update this PR to be documentation-only as suggested. |
Description
HTTP_HOSTincludes the port (e.g.example.com:8080), so routes restrictedby the
hostnameoption never matched on non-standard ports. The host is nowstripped of the port and validated (domain, IPv4, IPv6) before comparison.
Checklist: