Can't Set "Host:" Header with CURL Request

Question

I am trying to make a CURL request with some basic authentication (through sending an encrypted header). However, when I try to set the "Host: _" header, the remote server responds with:

Bad Request: Your browser sent a request that this server could not understand.

Here's the code that makes the CURL call. Note that it works as soon as I comment out the "Host: url" header in the $http_header variable. However, it is used on the target server as part of the authentication procedure, so I can not simply remove it.

    $curl = curl_init();

    $opt = array(
        CURLOPT_URL=>$url,
        CURLOPT_RETURNTRANSFER=>1,
        CURLOPT_HTTPHEADER=>$http_header,
        CURLOPT_POST=>1,
        CURLOPT_POSTFIELDS=>$data_params,
        CURLOPT_CONNECTTIMEOUT=>5, // Timeout to 5 seconds
    );
    curl_setopt_array($curl, $opt);

    // $output contains the output string
    $output = curl_exec($curl);

    // it closes the session
    curl_close($curl);

The contents of $http_header (an associative array):

array
  0 => string 'Host: http://localhost/work/myproject'
  1 => string 'Content-Type: multipart/form-data'
  2 => string 'X-Authorization: Basicauth Z2xZjA2YzJhMzIxYTI1ZmIzZTgxYQ=='

Solution 1

The Host header doesn't accept a full URL, but only a hostname.

In this case the solution is to replace this header:

"Host: $url"

with:

"Host: ". parse_url($url, PHP_URL_HOST) ."

Solution 2

The Host header takes a hostname, not a URL. i.e. localhost, not http://localhost/work/myproject.

cURL should be generating it automatically from CURLOPT_URL though.

Solution 3

The Host header should not contain the protocol, only the host's name. So in this case all you need is localhost:

'Host: localhost'