Lighttpd

Version 1.4.22 with ascii 9 patch

Sorry was set and didn't realize

192.168.14.135/thomson doesn't seem like a valid value for the Host header
Plus the path of the GET request is kinda strange. Not forbidden per se but strange nonetheless.

Isn't this covered by rule 1 when full uri is given host must be ignored and thus not validated ?:

5.2 The Resource Identified by a Request

The exact resource identified by an Internet request is determined by examining both the Request-URI and the Host header field.

An origin server that does not allow resources to differ by the requested host MAY ignore the Host header field value when determining the resource identified by an HTTP/1.1 request. (But see section 19.6.1.1 for other requirements on Host support in HTTP/1.1.)

An origin server that does differentiate resources based on the host requested (sometimes referred to as virtual hosts or vanity host names) MUST use the following rules for determining the requested resource on an HTTP/1.1 request:

1. If Request-URI is an absoluteURI, the host is part of the Request-URI. Any Host header field value in the request MUST be ignored.

2. If the Request-URI is not an absoluteURI, and the request includes a Host header field, the host is determined by the Host header field value.

3. If the host as determined by rule 1 or 2 is not a valid host on the server, the response MUST be a 400 (Bad Request) error message.

Recipients of an HTTP/1.0 request that lacks a Host header field MAY attempt to use heuristics (e.g., examination of the URI path for something unique to a particular host) in order to determine what exact resource is being requested.

Looks like you are right... effing standard :(
Why allow sending a Host: header if you have to ignore it?...

I don't know if there are annotated standards explaining the rationale of things like this (it always helps to know why), but if their alternative for handling this case was to say "the client must not do this and the server must return an error if it happens", then it'd just be that much more complicated for everyone.

I wonder if someone like Apache has a test suite that could be reused to check obscure cases like this. Feels like a lot of duplicated work for stuff that almost everyone developing an HTTP server is going to get bitten by independently...