framework/web/Request.php
public function getHostInfo()
    {
        if ($this->_hostInfo === null) {
            $secure = $this->getIsSecureConnection();
            $http = $secure ? 'https' : 'http';

            if ($this->headers->has('X-Forwarded-Host')) {
                $this->_hostInfo = $http . '://' . trim(explode(',', $this->headers->get('X-Forwarded-Host'))[0]);
            } elseif ($this->headers->has('Host')) {
                $this->_hostInfo = $http . '://' . $this->headers->get('Host');
            } elseif (isset($_SERVER['SERVER_NAME'])) {
                $this->_hostInfo = $http . '://' . $_SERVER['SERVER_NAME'];
                $port = $secure ? $this->getSecurePort() : $this->getPort();
                if (($port !== 80 && !$secure) || ($port !== 443 && $secure)) {
                    $this->_hostInfo .= ':' . $port;
                }
            }
        }

        return $this->_hostInfo;
    }
public function getHostInfo()
    {
        if ($this->_hostInfo === null) {
            $secure = $this->getIsSecureConnection();
            $http = $secure ? 'https' : 'http';

            if ($this->headers->has('X-Forwarded-Host')) {
                $this->_hostInfo = $http . '://' . trim(explode(',', $this->headers->get('X-Forwarded-Host'))[0]);
            } elseif ($this->headers->has('Host')) {
                $this->_hostInfo = $http . '://' . $this->headers->get('Host');
            } elseif (isset($_SERVER['SERVER_NAME'])) {
                $this->_hostInfo = $http . '://' . $_SERVER['SERVER_NAME'];
                $port = $secure ? $this->getSecurePort() : $this->getPort();
                if (($port !== 80 && !$secure) || ($port !== 443 && $secure)) {
                    $this->_hostInfo .= ':' . $port;
                }
            }
        }

        return $this->_hostInfo;
    }
Returns the schema and host part of the current request URL.

The returned URL does not have an ending slash.

By default this value is based on the user request information. This method will
return the value of `$_SERVER['HTTP_HOST']` if it is available or `$_SERVER['SERVER_NAME']` if not.
You may want to check out the [PHP documentation](https://secure.php.net/manual/en/reserved.variables.server.php)
for more information on these variables.

You may explicitly specify it by setting the [[setHostInfo()|hostInfo]] property.

> Warning: Dependent on the server configuration this information may not be
> reliable and [may be faked by the user sending the HTTP request](https://www.acunetix.com/vulnerabilities/web/host-header-attack).
> If the webserver is configured to serve the same site independent of the value of
> the `Host` header, this value is not reliable. In such situations you should either
> fix your webserver configuration or explicitly set the value by setting the [[setHostInfo()|hostInfo]] property.
> If you don't have access to the server configuration, you can setup [[\yii\filters\HostControl]] filter at
> application level in order to protect against such kind of attack.

@property string|null schema and hostname part (with port number if needed) of the request URL
(e.g. `http://www.yiiframework.com`), null if can't be obtained from `$_SERVER` and wasn't set.
See [[getHostInfo()]] for security related notes on this property.
@return string|null schema and hostname part (with port number if needed) of the request URL
(e.g. `http://www.yiiframework.com`), null if can't be obtained from `$_SERVER` and wasn't set.
@see setHostInfo()