Authority Ambiguity Vulnerabilities in NGINX and Debian’s proxy_params

Friends don't let friends use $http_host

Published: May 28 2026

Two related authority-ambiguity vulnerabilities in NGINX and Debian's proxy_params configuration snippet.

nginx, Logstash and vhost-combined log format

Published: Jan 11 2015

The Apache HTTP server ships with a split-logfile utility which parses Combined Log File entries prefixed with the virtual host: some notes about this and its inclusion in nginx and logstash.