The internal IP address is revealed in HTTP1.0

The internal IP address is revealed in HTTP1.0

Applies to


Alert
All versions of Cryptshare Server

Symptom

When requesting a page from a Cryptshare Server, the internal IP address of the server is revealed:
Notes
nc my.cryptshare.server 80

GET / HTTP/1.0

HTTP/1.1 302 Found
Date: Fri, 12 Jun 2015 07:43:06 GMT
X-Frame-Options: SAMEORIGIN
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, no-store
Content-Length: 0

Cause

HTTP 1.0 does not support the host-header and the Jetty Server therefore uses the server IP address instead. 

Solution

Please set the parameter virtualHosts.restrict in the system.properties file to true. See Advanced Configuration: Virtual Host Restriction