I'm quite concerned about the security of the web apps I build, so I've been using various tools to crawl each one of my apps.

Whilst everything that can be done in term of programming, and is not foreseen by the ready classes, like Active Record, is done, there is one issue I keep getting alerts for which I do not know where to start fixing this.

I'm running `Unicorn` behind `Nginx` and `Rails 4.1`. The alert I keep getting is this:

```
    An attacker can manipulate the Host header as seen by the 
web application and cause the application to behave in 
unexpected ways. Developers often resort to the exceedingly 
untrustworthy HTTP Host header (_SERVER["HTTP_HOST"] in PHP). 
Even otherwise-secure applications trust this value enough to 
write it to the page without HTML-encoding it with code equivalent to:

<link href="https://_SERVER['HOST']" (Joomla)

...and append secret keys and tokens to links containing it:

(Django, Gallery, others)

....and even directly import scripts from it:

(Various) 

```

The following recommendation is issued:

```
The web application should use the SERVER_NAME instead
of the Host header. It should also create a dummy vhost 
that catches all requests with unrecognized Host headers. 
This can also be done under Nginx by specifying a non-wildcard 
SERVER_NAME, and under Apache by using a non-wildcard serverName 
and turning the UseCanonicalName directive on. Consult references 
for detailed information.

```

Sure, whatever.. This vulnarability as I understand is generically harmless but could be harmful in a variety of web applications, depending on their kind.

What do I do to block this kind of attack? Thanks for any suggestions.