Links: 1-17-2006

Links: 1-11-2006

ASP, ServerVariables, Server_Name, Windows 2003, IIS6

We’re in the process of upgrading our webservers to Windows 2003 and thus IIS6. One of the issues we ran into was that the Server_Name key of the ServerVariables collection in VBScript started returning the computer name of the machine rather than the host name of the website. I spent a couple hours googling and found nothing, my recent hire found the hot fix on microsoft.com in about 5 minutes today (which shows how important good google skills are). In short, there’s a security issue with IIS (surprised?) whereby sending a GET request to an IIS web server without sending a host header would result in the web server returning the IP address of the web server in the content location field of the response TCP header. The easy fix is to run:

cscript adsutil.vbs set w3svc/UseHostName false

which modifies all IIS web sites to return the website host name rather than the machine name / IP address when getting the Server_Name key of the ServerVariables collection.