[squid-users] Squid proxy will forward message with 'alternating host header' but logs another?

[Alex Rousskov]

On 10/31/19 7:48 AM, Mark Bergman wrote:
>     logformat combined2 ... %ru ... "%>h"

> example log line:

>     ... http://www.google.com/ ... "...Orig-Host:
>     someevilhost.appspot.com\r\nHost:
>     www.google.com\r\n" 


> I'm looking for a  way to have Squid log the original request

You are already doing the right thing. Squid promises that "%>h" is the
received request header [before any adaptations, including the Host
header rewrites]. There is a bug in Squid that breaks that documentation
promise and makes it impossible to log what you want without changing
Squid code. Quality pull requests fixing that bug (or their sponsorship)
are welcomed.


HTH,

Alex.