Skip to main content

11. Quick Checks for Host Header Attacks

Web applications often use the Host value to build redirect URLs, absolute links, and email or password-reset links. If the trust boundaries between the proxy, cache, and application do not align, this can lead to Open Redirects, link hijacking, or cache poisoning.

Common Triggers​

  • The application uses Host directly to construct URLs
  • The proxy trusts X-Forwarded-Host
  • The cache key does not include the Host value

Mini CTF Checklist​

  • Check whether Host: evil.com changes a reset link
  • Inspect the precedence of X-Forwarded-Host
  • Test whether different Host values can poison the cache for the same path

Defensive Measures​

  • Maintain an allowlist of permitted Host values
  • Use a fixed server configuration value when generating absolute URLs
  • Include and isolate Host values in cache keys

A single configuration mistake can direct users to an external domain, so the key is to inspect both the reverse proxy and application configuration together.