ASP, ServerVariables, Server_Name, Windows 2003, IIS6

We’re in the process of upgrading our webservers to Windows 2003 and thus IIS6. One of the issues we ran into was that the Server_Name key of the ServerVariables collection in VBScript started returning the computer name of the machine rather than the host name of the website. I spent a couple hours googling and found nothing, my recent hire found the hot fix on microsoft.com in about 5 minutes today (which shows how important good google skills are). In short, there’s a security issue with IIS (surprised?) whereby sending a GET request to an IIS web server without sending a host header would result in the web server returning the IP address of the web server in the content location field of the response TCP header. The easy fix is to run:

cscript adsutil.vbs set w3svc/UseHostName false

which modifies all IIS web sites to return the website host name rather than the machine name / IP address when getting the Server_Name key of the ServerVariables collection.

One thought on “ASP, ServerVariables, Server_Name, Windows 2003, IIS6”

  1. I just had this problem. Unfortunatly for me, cscript adsutil.vbs set w3svc/UseHostName false did nothing but choke up errors.

    The KB article I found about it doesn’t mention that version, but only the version where you specify the site number:

    cscript adsutil.vbs set w3svc/1/UseHostName false

    THat’s the only version that worked for me.
    Now the real answer is, I should be using the LOCAL_ADDR variable instead of the SERVER_NAME property.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>