Sitemap.xml site urls change on cache refresh

[petertindemans]

I experience some strange behaviour with with the sitemap.xml content when on cache refresh. When you load the content it shows the right URL for example, when you clear the cache, it shows a random different url.

In the example below even a .ru domain is used, its not even in the site configuration.

Information:
Craft CMS 3.4.22.1
SEOmatic 3.3.8

First sitemap:

After cache refresh:

[khalwat]

It must be getting this information from somewhere -- my guess is that you may not have your siteUrl set up in config/general.php ?

Or are you using the out of the box @web alias (which is not recommended due to cache poisoning)? craftcms/cms#3559

[khalwat]

I'm going to assume it's this:

https://twitter.com/nystudio107/status/1074429502615379968

https://docs.craftcms.com/v3/sites.html#creating-a-site

Don’t ever use the @web alias when defining your sites’ Base URLs. It could introduce a cache poisoning vulnerability, and Craft won’t be able to reliably determine which site is being requested

Basically, if you use the @web alias for your siteUrl or Asset Volume URLs without explicitly defining it, Yii2 tries to dynamically determine it, but it can be set to whatever the client wants it set to.

So explicitly set the @web alias or use some other explicitly defined alias or environment variable for your site's siteUrl and Asset Volume URLs.