SuspiciousOperationException: Invalid Host error

Question

everyone

I have a website built with Laravel 5.4 (latest version) and I'm getting this "SuspiciousOperationException: Invalid Host error" on my logs many times a day. Even though it doesn't seem to be affecting my website's functionality, I'm worried it might be a symptom of some misconfiguration – and, at the very least, it's polluting my log files, making error tracking a little harder.

I've tried to figure out what's causing this on my own, but my lack of experience has shown… I have some idea of what might be causing this, but I have no confirmation of my theory and I have no clue of how to solve the issue.

The error message is the following:

[2017-08-03 23:47:03] production.ERROR: Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException: Invalid Host "*.example.com". in /var/www/laravel/vendor/symfony/http-foundation/Request.php:1283

And the stack trace:

#0 /var/www/laravel/vendor/symfony/http-foundation/Request.php(1088): Symfony\Component\HttpFoundation\Request->getHost()
#1 /var/www/laravel/vendor/symfony/http-foundation/Request.php(1118): Symfony\Component\HttpFoundation\Request->getHttpHost()
#2 /var/www/laravel/vendor/symfony/http-foundation/Request.php(1815): Symfony\Component\HttpFoundation\Request->getSchemeAndHttpHost()
#3 /var/www/laravel/vendor/symfony/http-foundation/Request.php(1102): Symfony\Component\HttpFoundation\Request->prepareRequestUri()
#4 /var/www/laravel/vendor/symfony/http-foundation/Request.php(1867): Symfony\Component\HttpFoundation\Request->getRequestUri()
#5 /var/www/laravel/vendor/symfony/http-foundation/Request.php(985): Symfony\Component\HttpFoundation\Request->prepareBaseUrl()
#6 /var/www/laravel/vendor/symfony/http-foundation/Request.php(1933): Symfony\Component\HttpFoundation\Request->getBaseUrl()
#7 /var/www/laravel/vendor/symfony/http-foundation/Request.php(945): Symfony\Component\HttpFoundation\Request->preparePathInfo()
#8 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Http/Request.php(138): Symfony\Component\HttpFoundation\Request->getPathInfo()
#9 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Matching/UriValidator.php(19): Illuminate\Http\Request->path()
#10 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Route.php(259): Illuminate\Routing\Matching\UriValidator->matches(Object(Illuminate\Routing\Route), Object(Illuminate\Http\Request))
#11 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/RouteCollection.php(193): Illuminate\Routing\Route->matches(Object(Illuminate\Http\Request), true)
#12 [internal function]: Illuminate\Routing\RouteCollection->Illuminate\Routing\{closure}(Object(Illuminate\Routing\Route), 'api/user')
#13 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Support/Arr.php(175): call_user_func(Object(Closure), Object(Illuminate\Routing\Route), 'api/user')
#14 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/RouteCollection.php(194): Illuminate\Support\Arr::first(Array, Object(Closure))
#15 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/RouteCollection.php(164): Illuminate\Routing\RouteCollection->matchAgainstRoutes(Array, Object(Illuminate\Http\Request))
#16 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Router.php(548): Illuminate\Routing\RouteCollection->match(Object(Illuminate\Http\Request))
#17 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Router.php(527): Illuminate\Routing\Router->findRoute(Object(Illuminate\Http\Request))
#18 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Router.php(513): Illuminate\Routing\Router->dispatchToRoute(Object(Illuminate\Http\Request))
#19 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(176): Illuminate\Routing\Router->dispatch(Object(Illuminate\Http\Request))
#20 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(30): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}(Object(Illuminate\Http\Request))
#21 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(30): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request))
#22 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(148): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle(Object(Illuminate\Http\Request), Object(Closure))
#23 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#24 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(30): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request))
#25 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(148): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle(Object(Illuminate\Http\Request), Object(Closure))
#26 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#27 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request))
#28 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(148): Illuminate\Foundation\Http\Middleware\ValidatePostSize->handle(Object(Illuminate\Http\Request), Object(Closure))
#29 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#30 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/CheckForMaintenanceMode.php(46): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request))
#31 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(148): Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode->handle(Object(Illuminate\Http\Request), Object(Closure))
#32 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#33 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request))
#34 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(148): Illuminate\Session\Middleware\StartSession->handle(Object(Illuminate\Http\Request), Object(Closure))
#35 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#36 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request))
#37 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(148): Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse->handle(Object(Illuminate\Http\Request), Object(Closure))
#38 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#39 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(59): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request))
#40 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(148): Illuminate\Cookie\Middleware\EncryptCookies->handle(Object(Illuminate\Http\Request), Object(Closure))
#41 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#42 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(102): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request))
#43 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(151): Illuminate\Pipeline\Pipeline->then(Object(Closure))
#44 /var/www/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(116): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter(Object(Illuminate\Http\Request))
#45 /var/www/laravel/public/index.php(53): Illuminate\Foundation\Http\Kernel->handle(Object(Illuminate\Http\Request))
#46 {main} 

The configuration data that I think might be related is as follows:

.env:

APP_URL=example.com

(I've tried a few other values like the ones below:)

http://www.example.com
http://*.example.com

config/app:

'url' => env('APP_URL', 'example.dev')

My website works on both http://example.com and http://www.example.com ; I've noticed that sessions aren't shared between them, but everything else is the same.

Any help solving this issue would be much appreciated. Thank you in advance!

EDIT: redacted the domain name

Answer 1

I had the same issue, but for me removing the wildcard from my nginx server_name directive wasn't an option. (My website depends on dynamic subdomain routing).

The problem is related to PHP variable $_SERVER['SERVER_NAME'] not being set correctly by nginx when there is a wildcard in the server_name. To fix it, you have to add the following in your nginx config:

fastcgi_param SERVER_NAME $host

For example:

location ~ \.php$ {
    ...
    fastcgi_param SERVER_NAME $host
    ...
}

Answer 2

I've finally tracked down what was causing this: it was nginx's configuration.

I had configured my server's server_name directive as *.example.com – which is a valid wildcard name for the directive, as seen at http://nginx.org/en/docs/http/server_names.html , but doesn't seem to play well with Laravel. I haven't had this exception be thrown since I changed the value to example.com www.example.com a couple of days ago, so this definitely seemed to do the trick.