commit 607335a

Try to avoid host header misconfigurations in check_signature().

 1@@ -223,6 +223,19 @@ int check_signature(xs_dict *req, xs_str **err)
 2             if (strcmp(v, "(expires)") == 0) {
 3                 ss = xs_fmt("%s: %s", v, expires);
 4             }
 5+            else
 6+            if (strcmp(v, "host") == 0) {
 7+                hc = xs_dict_get(req, "host");
 8+
 9+                /* if there is no host header or some garbage like
10+                   address:host has arrived here due to misconfiguration,
11+                   signature verify will totally fail, so let's Leroy Jenkins
12+                   with the global server hostname instead */
13+                if (hc == NULL || xs_str_in(hc, ":") != -1)
14+                    hc = xs_dict_get(srv_config, "host");
15+
16+                ss = xs_fmt("host: %s", hc);
17+            }
18             else {
19                 /* add the header */
20                 if ((hc = xs_dict_get(req, v)) == NULL) {