Host Header Injection
Overview
Applications that trust the Host header for generating links (password reset emails, canonical URLs) are vulnerable to Host Header Injection. Attackers set a malicious Host: header, causing the app to generate links pointing to the attacker's domain. The victim clicks a password reset link containing an attacker-controlled URL.
Remediation
- Configure your web application with an explicit trusted host list
- Use Django's
ALLOWED_HOSTS, Laravel'sconfig/app.phpURL, or server-side canonical URL - Validate the
Hostheader against an allowlist before using it