Host Header Injection
Host header injection exploits servers that trust the Host header for URL construction — password-reset links, redirects, cache keys — producing poisoned links and cache entries.
Definition
Host header injection is the flaw of building absolute URLs or routing decisions from the attacker-controlled Host or X-Forwarded-Host header without validation. Reset emails, canonical redirects, and cached pages end up pointing at attacker domains. It feeds password-reset poisoning and web cache poisoning.
Context and scope
Found in frameworks deriving request.base URL, password reset mailers, and multi-tenant routing by hostname. Proxies often append X-Forwarded-Host that origins blindly trust.
Common misconceptions
- The proxy sets the Host header safely — proxies forward what the client sent unless configured to override; forwarded headers need explicit trust
- Host is irrelevant behind TLS — virtual hosting means any SNI or Host value reaches the same vhost, and unvalidated values flow into templates
- Validation means checking the suffix — attacker-controlled domains like evil.example.com pass naive example.com checks
Anti-patterns
- Generating password-reset links from the request Host and emailing them to arbitrary addresses
- Trusting X-Forwarded-Host blindly because one trusted proxy exists in front
- Building cache keys from Host without an allowlist, poisoning shared caches per hostname
Related concepts
Related examples
Authoritative source
What it is
The Host header is client input. When the application treats it as configuration — the canonical domain — every URL it constructs inherits attacker control. The most damaging flow is password reset: a victim clicks a link that carries the reset token to the attacker domain.
How it works
The attacker requests the reset flow with a manipulated Host or an injected X-Forwarded-Host. The mailer renders the link against that host and sends it. Hardening: derive base URLs from verified configuration, validate Host against an exact allowlist per environment, and clear or overwrite forwarding headers at the edge unless the proxy chain is trusted hop by hop.
When to audit
Mail rendering, redirect generation, OAuth callback construction, and any absolute-URL assembly from request context. Multi-tenant apps routing by hostname must distinguish tenant lookup, which is legitimate, from URL construction, which is not.
Pitfalls
Duplicate Host headers and absolute-URI request targets create parser differentials between proxy and origin — the smuggling family. Caches that vary on Host without allowlists give attackers per-hostname poisoning keys. Test both the header and every forwarding variant your chain produces.