TRUE ONLY WHERE THE QUERY STRING IS OURS. On /serve the caller built the URL and the
parameter is an instruction; on a path the catch-all rewrote, the query belongs to Drupal and
came from the visitor -- so honouring it means https://customer-a.example/about?site=customer-b
serves customer B's database from customer A's hostname. Rewriting from the ORIGIN keeps the
visitor's parameters out of /serve's own, and this keeps them out of the resolution that
chooses which object answers; both halves are needed.
Whether
?site=on the URL may name the site.TRUE ONLY WHERE THE QUERY STRING IS OURS. On
/servethe caller built the URL and the parameter is an instruction; on a path the catch-all rewrote, the query belongs to Drupal and came from the visitor -- so honouring it meanshttps://customer-a.example/about?site=customer-bserves customer B's database from customer A's hostname. Rewriting from the ORIGIN keeps the visitor's parameters out of/serve's own, and this keeps them out of the resolution that chooses which object answers; both halves are needed.