Proxy not rejecting illegal host header when coming from my VM provider's network

Question

I have a django app hosted on a linode VM, proxied by nginx on that same VM.

In my nginx config I have a block to deny bad host header requests:

## Deny illegal Host headers
if ($host !~* ^(mydomain.com|www.mydomain.com)$ ) {
    return 444;
}

This blocks almost all the bad requests, but I'm still getting occasional requests from a random linode host (the app sends me an email due to this host not being in the ALLOWED_HOSTS whitelist). Why are those requests able to get past nginx?

Answer 1

$host will be set to $server_name if the client does not provide a Host header value in the request. You should use $http_host to access the pure Host header.

See this document for details.