What is the Host Header?

Q: What is the Host Header?

The Host Header is the request header that reports which domain the request is made to (and, on a non-standard port, together with the port); in HTTP/1.1 it must be present in every request, and in HTTP/2 and HTTP/3 the same information is carried by the :authority field. Separating multiple sites on the same IP address relies on this. In TR7, the Host Header is the input of many decisions: the Virtual Hosting list of the HTTP vService selects the vService by the Host value in unencrypted requests; the URL condition takes the host part of the address from the Host Header; the Cache profile includes Host in the cache key by default (it is removed with Ignore Host Header); the Virtual Host Groups of WAF assign the request to a host group by the Host value; if SNI/Host Validation in TLS Security Profiles is enabled, SNI and Host must point to the same domain.

Short answer

The Host header is the request header that reports which domain the request is made to (and, on a non-standard port, together with the port); in HTTP/1.1 it must be present in every request, and in HTTP/2 and HTTP/3 the same information is carried by the :authority field. Separating multiple sites on the same IP address relies on this. In TR7, the Host header is the input of many decisions: the Virtual Hosting list of the HTTP vService selects the vService by the Host value in unencrypted requests; the URL condition takes the host part of the address from the Host header; the Cache profile includes Host in the cache key by default (it is removed with Ignore Host Header); the Virtual Host Groups of WAF assign the request to a host group by the Host value; if SNI/Host Validation in TLS Security Profiles is enabled, SNI and Host must point to the same domain.

Where It Is Used in TR7

Where	Field / label	What for
`Load Balancer` → `Load Balancer vService List` → HTTP vService form	Virtual Hosting	Selection among the vServices that share the same IP:port: the Host value in an unencrypted request, SNI in HTTPS
`Load Balancer` → `Conditions (Policy Match)` → Criteria	URL, HTTP Header (Header name: `Host`)	An action or Conditional Backend Services decision based on the domain
`Load Balancer` → `Profiles (L4-L7 Behavior Sets)` → `Cache`	Ignore Host Header (off by default)	Removing Host from the cache key
`Load Balancer` → `Profiles (L4-L7 Behavior Sets)` → `Health Checks` → HTTP / HTTPS profile	Virtual Domain (Host/SNI)	The Host (and, in HTTPS, SNI) value to be sent in the health check request
`Certificates & PKI` → `TLS Security Profiles`	SNI/Host Validation	Rejecting with 421 an HTTPS request whose SNI and Host do not match
Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Virtual Host Groups	Virtual Host Patterns	Which host group's rules and mode the request is evaluated with

Common Misconceptions

"The Host header is determined by the IP address." The client writes Host; requests that come to the same IP with different domains carry different Host values.
"Host and SNI are always the same." SNI is sent in the TLS handshake and Host in the HTTP request, and they can be different; TR7 optionally validates this with SNI/Host validation (What is SNI (Server Name Indication)?).
"The WAF host pattern ignores the port and the case difference in the Host value." Virtual Host Patterns are compared with the Host value as it is; on a non-standard port, the port is also written into the pattern (Which host group does a request without a Host Header fall into?).

How it is done in the documentation

What is the Host Header? ​

Where It Is Used in TR7 ​

Common Misconceptions ​

What is the Host Header?

Where It Is Used in TR7

Common Misconceptions