Re: [OT] IIS, domains, routers and host headers

[Doogie Brodie <ukhad@xxxxxxx>]

Paul Gale wrote:

> Thanks Doogie - that made good sense :-)

Phew :)

> One question though - what happens if I have two web sites setup with
ClientSite1 and ClientSite2 and ClientSite1 is mapped through the router
(domain of say ClientSite1.mydomain.com with a public IP address of course)
- the router forwards traffic for port 80 to the internal server on
192.168.0.1 - but ClientSite2 doesn't have a separate mapping or public
domain/IP etc. Is there any way of getting to ClientSite2 from the Internet
- how secure is it then? (Where does IIS get the header info from - browser
URL box???)
> Did that question make sense?

Yip.....

IIS takes the host header info from what's entered into the browser; it
is possible therefore in the scenario you've described, for someone to
put the corresponding host header name into their hosts file for
ClientSite2, pointing it at ClientSite1's external IP address, and get
served ClientSite2.

You can of course make this more "secure" by using multiple IP
addresses
internally as mentioned by someone else, the use of that externally
depends on how many external IPs you have. You can also implement things
like windows authentication etc to request logins.

--
Doogie