Earlier quoted context omitted.
Stack overflow uses IIS??
Yes, I believe it was built using the .NET framework.
Built on asp.net MVC http://blog.stackoverflow.com/2008/09/what-was-stack-overflo...
The danger of the trailing dot in the domain name
31–40 of 75 posts
Re: The danger of the trailing dot in the domain name
#32Earlier quoted context omitted.
The 400 error is just the web server complaining that there is no web site to deliver to you for that hostname. It isn't complaining about the hostname being invalid, per se.
I thought so too, but then I made a little experiment: pilif@shion:~$ curl -I -H "Host: example.com" http://198.252.206.16/ HTTP/1.1 404 Not Found Content-Length: 4129 Date: Sat, 16 Mar 2013 12:28:22 GMT vs. pilif@shion:~$ curl -I -H "Host: example.com." http://198.252.206.16/ HTTP/1.1 400 Bad Request Content-Length: 334 Content-Type: text/html; charset=us-ascii Date: Sat, 16 Mar 2013 12:28:56 GMT The IP is the one f…
That's odd, I would have thought that '404 Not Found' would be the wrong response to send, although you could argue either way.
I used to develop a web server ages ago (Zeus Web Server), it would try and match the Host: header against all the sites it was configured to server, and if none matched, it would send a 400 error back.
(Incidentally, it would happily strip off the trailing dot from the hostname)
Re: The danger of the trailing dot in the domain name
#33Why is this something that people do?
Because they can.
Curiosity is a very strong and very valid reason to do things. It can very often lead to new insights.
And of course it is also necessary from a security point of view to test these kinds of things to see if they lead to strange behaviour.
Re: The danger of the trailing dot in the domain name
#34http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/web... > [The trailing dot in the domain name is] there for a reason. It made the domain name a fully qualified one, and thus unambiguous and not prone to search path spoofing. [snip] > For example: Posit that the web browser uses the BIND DNS Client library and the search example.net directive is present in that library's resolv.conf configuration file. > In t…
The search path spoofing argument is weak. If you depend on a DNS resolver that spoofs domain searches, what guaranteed that it wouldn't simply spoof the full resolution as well ? In practice nobody uses the dot at the end except when writing BIND files.
The DNS resolver doesn't need to spoof anything. If you're on network example.net and there's a server on that network called "google" then typing "google" into your address bar will resolve to google.example.net in a completely legitimate way, with no DNS spoofing.
Re: The danger of the trailing dot in the domain name
#35The trailing dot (.) at the end of the domain name denotes the root nameservers. There are 13 such servers in the world.
$ dig ns .
; > DiG 9.8.1-P1 > ns . ;; global options: +cmd ;; Got answer: ;; ->>HEADER;; QUESTION SECTION: ;. IN NS
;; ANSWER SECTION: . 21088 IN NS a.root-servers.net. . 21088 IN NS b.root-servers.net. . 21088 IN NS c.root-servers.net. . 21088 IN NS d.root-servers.net. . 21088 IN NS e.root-servers.net. . 21088 IN NS f.root-servers.net. . 21088 IN NS g.root-servers.net. . 21088 IN NS h.root-servers.net. . 21088 IN NS i.root-servers.net. . 21088 IN NS j.root-servers.net. . 21088 IN NS k.root-servers.net. . 21088 IN NS l.root-servers.net. . 21088 IN NS m.root-servers.net.
;; Query time: 51 msec ;; SERVER: 127.0.1.1#53(127.0.1.1) ;; WHEN: Sat Mar 16 19:32:57 2013 ;; MSG SIZE rcvd: 228
This is very helpful in DNS propagation and pointing the appropriate authoritative zone for all the TLDs.
Re: The danger of the trailing dot in the domain name
#36The trailing dot (.) at the end of the domain name denotes the root nameservers. There are 13 such servers in the world. $ dig ns . ; > DiG 9.8.1-P1 > ns . ;; global options: +cmd ;; Got answer: ;; ->>HEADER ;; QUESTION SECTION: ;. IN NS ;; ANSWER SECTION: . 21088 IN NS a.root-servers.net. . 21088 IN NS b.root-servers.net. . 21088 IN NS c.root-servers.net. . 21088 IN NS d.root-servers.net. . 21088 IN NS e.root-server…
Every "web developer" should read the first three chapters of the Cricket book. The profound ignorance (that many web developers have) of DNS is inexcusable:
http://www.amazon.com/DNS-BIND-5th-Cricket-Liu/dp/0596100574
Re: The danger of the trailing dot in the domain name
#37You can cd to /home/user or /home/user/ as well. The dot's in DNS are equivalent to the slashes in your Unix file system.
/ is root
. is root
I'm shocked that many people on HN don't seem to understand this.
Re: The danger of the trailing dot in the domain name
#38Where have we got to the point where a relative hostname is accepted by 100% of websites yet an absolute hostname isn't? Surely it should be the other way round, this is a ridiculous state of affairs!
Re: The danger of the trailing dot in the domain name
#39Just tried it with my app on heroku and get an HTTP 404 "no such app" error. Tried to add www.mydomain.com. to the domain list in the admin interface. Didn't work either stating "Domain is invalid". Gna...
Use example.com in examples, since mydomain.com is an actual website.
Re: The danger of the trailing dot in the domain name
#40The fact that the two IIS based sites (Microsoft, Stack overflow) both fail with an outright error 400 complaining about a bad host name makes me wonder whether this might actually be a bug in IIS to overzealously validate the hostname. The trailing dot is totally valid and there's no need to complain.
> whether this might actually be a bug in IIS to overzealously validate the hostname.
Our two websites both redirect to the version without the dot, both running on IIS6 so it can indeed handle it.