A
A
Araik2019-10-24 21:00:59
PHP
Araik, 2019-10-24 21:00:59

How to implement multisite on one CMS?

Good afternoon, I want to implement multi-site (tens-hundreds of sites) on one CMS instance.
Interested in 2 questions, the first one is essentially:
1) Is it enough to check and route requests based on $_SERVER['HTTP_HOST'] \ $_SERVER['SERVER_NAME'] ? Perhaps it makes sense to use $_ENV ?
The idea is the following: roughly speaking, if $_SERVER['SERVER_NAME'] == 'example.com', pull up the settings for example.com and pass it to the bootstrap;

$domens = array ('example.com');

if ($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_NAME']) {
  // Мы знаем, что HTTP HOST, и даже SERVER_NAME можно подделать,
  // поэтому проверяем корректность данных
  if (!preg_match("/^[a-z0-9.]+$/i", $_SERVER['SERVER_NAME'])) {
    echo 'Некорректный HTTP HOST или SERVER_NAME';
    exit();
  }
  
  $host = $_SERVER['SERVER_NAME'];
  // Проверяем если запрошенный хост в нашей базе (предположим база в массиве)
  if (in_array($host, $domens)) {
    // передаем конфиги и запускаем сайт
  }
} else {
  echo 'HTTP_HOST != SERVER_NAME. Why?';
  exit();
}

(I hope it's clear that this is just an example and the code will be different in a real project)
Does it make sense to check $_SERVER['HTTP_HOST'] == $_SERVER['SERVER_NAME'] ?
To what extent is this the right decision? Are there alternatives?
The second question, a continuation of the first, what are the disadvantages of this solution? Maybe the implementation of such functionality is done in a completely different way?

Answer the question

In order to leave comments, you need to log in

1 answer(s)
A
Araik, 2019-10-24
@NinjaNickName

Partially found the answer here: About one little-known vulnerability in web sites
In general, the answer is, yes, quite a working solution, such code has the right to life.
It depends on the web server settings, HTTP_HOST is not always equal to SERVER_NAME, but if everything is configured correctly, then HTTP_HOST should be equal to SERVER_NAME; I think there is no point in checking, just check SERVER_NAME, correct me if I'm wrong.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question