Express: req.host / hostname confusion makes vhost behave incorrectly!

[gaurav21r]

Although this has already been dealt with in #2179 , the conversation has been limited to collaborators AND it is slated for a 5.0 release. I think this may warrant a more immediate fix in the 4.x branch?

For a server setup where multiple products (domains) are going to run from the same express server, my use case is this:

In a local machine

In a local machine, we have 2 environments, dev that is a developer environment and staging, that replicates a staging environment. Since there can only be one localhost hostname in a dev environment, we run 2 different server.jss. Either use the vhost module to correctly pickup the correct route.

In a production machine

This won't matter as we'll use different hostnames anyway!

Due to the way req.host is structured, I get:

app.use(vhost(localhost:8000), routes1)
app.use(vhost(localhost:3000), routes2)

window.fetch('http://localhost:8000/api/hello')
// Does not hit either!
// Because req.host is just localhost

So in Express 4.x I can never get the desired functionality!

Right now I can see Express has both req.host and req.hostname and they both strip the port.

1. Can we change either to the desired behaviour of stripping the ports?
2. I understand this would be a "breaking change".
   
   
   
   • a. Can we bump up the Middle version number for this?
   
   
   • b. If not, can we add some sort of configuration (say using app.set) which would enable this behaviour while keeping it default for 5.x ?
   
   

[dougwilson]

The vhost module does not use req.host

Can we change either to the desired behaviour of stripping the ports?

No, because req.host stripped the port before I came to this module and we cannot change this without a major version bump; req.hostname should not include the port, which it is doing correctly, as that is the difference between "host" and "hostname".

Can we bump up the Middle version number for this?

No. It's a breaking change.

If not, can we add some sort of configuration (say using app.set) which would enable this behaviour while keeping it default for 5.x ?

No, because then a setting will break middleware, which is not something we like to do.

[gaurav21r]

Can we then add something like req.hostWithPort or req.realHost or req.HOST` or something else on these lines? It won't be breaking and can silently disappear in the 5.x releases?

[dougwilson]

What is wrong with using req.headers.host?

[gaurav21r]

You are right! That's a good enough solution. Forgive me for taking up your time :) Maybe we could write this port mismatch in the README / documentation site more clearly? I'd love to submit a PR!

[dougwilson]

In the end, we have already resolved this issue in Express 5.x. Yes, it sucks that req.host is not the host and instead the hostname. It went years and years without being noticed until I did, and we can only really fix it with a major version bump, which we have done so.

No, adding some weird properties is not a good solution, especially since we cannot simply silently remove them. Anything that is removed in the next major is first deprecated in the preceding major with a warning being printed. This would mean if we added req.realHost in 4.x, we couldn't remove it in 5.x until we started printing a deprecation message in 4.x, at which point, it would have only existed as an annoying function that spewed deprecation warnings.

If you really need it, you can always adjust req.host in your own Express instance using the express.request object or define your own getter on it, there is no need to add it to core when it is very straight forward to implement it in your own code base as it is needed for your use-cases :)

Forgive me for taking up your time :)

It's no problem :)

Maybe we could write this port mismatch in the README / documentation site more clearly? I'd love to submit a PR!

Feel free! Anyone is welcome to contribute to our documentation, and the bottom of every documentation page, there is even a link to make a PR to alter that very page! The general repository to make a PR against is https://github.com/expressjs/expressjs.com

[jondb]

What is wrong with using req.headers.host?

This works. I did not see req.headers in the documentation.

[dougwilson]

Since this us not a property provided by Express directly, it is not documented directly in our API docs. Instead right at the top of the request section, we document

The req object is an enhanced version of Node’s own request object and supports all built-in fields and methods.

And a link is provided to the Node.js documentation. Since these methods and properties vary not by express version but instead by Node.js version, you have to refer to the Node.js docs.