Browsers send Host Header to inform about the URL client wants to visit. Attackers can temper Host Header to manipulate how the application works. Here is how this attack occurs:
Attacker mak...
Updated May 13, 2020
Version 2.0
Blog Post
I also notice that in a local LAN environment this requires you to use the FQDN.
On the domain you could typically go to https://servername and it would load.
Now you must use the FQDN like https://servername.domain.coim
Could the 301 permanant redirect handle switching to the FQDN for you? Instead of taking you to https://domain.com/ (which is nothing)... fill in the field with the server's FQDN so it redirect you to the full proper URL? ie) https://servername.domain.com/ - Not sure if that mitigates the vulnerability or not.
Also seeing conflicting info, should the initial rule pattern be (.) or (.*). Your screenshot contradicts your text instructions.