field Registered
Verified 2026-09-18 · registry updated
2026-08-28Host
Identifies the authority targeted by an HTTP/1.1 request.
Use Host for virtual hosting and validate it against accepted hostnames. HTTP/2 and HTTP/3 carry the authority as a pseudo-field.
httpheaderroutingsecurity
Reference (http)
Host: api.example.com
Use Host for virtual hosting and validate it against accepted hostnames. HTTP/2 and HTTP/3 carry the authority as a pseudo-field.
Common mistakes
- Using an unvalidated Host value to build password-reset links or cache keys.
IANA registry: http-fields/field-names
Registry reference: RFC 9110, Section 7.2: HTTP Semantics