Contents
Can you trust the host header?
If you haven’t yet caught it, this is a really bad practice. The Host header is provided by the client, meaning an attacker could embed their own website in a password reset email, compromising any user’s account. An attack scenario would look something like this: The attacker identifies a target user’s email address.
Is the host header always sent?
The Host request header specifies the host and port number of the server to which the request is being sent. If no port is included, the default port for the service requested (e.g., 443 for an HTTPS URL, and 80 for an HTTP URL) is implied. A Host header field must be sent in all HTTP/1.1 request messages.
Is HTTP Accept header mandatory?
Accept isn’t mandatory; the server can (and often does) either not implement it, or decides to return something else.
Is it possible to set the host header in a request?
This post goes over setting the Host header in a request. Since you control the website, would it be possible for you to have the link initiate a request to your own server that fires a customized HTTP request to the target site using cURL or some other tool that lets you specify the Host header?
What is the host name of an HTTP request?
For example, the host header name for the URL www.example.com is www.example.com. An HTML 3.0 or later browser supports HTTP 1.1. The browser includes the host header name you specified in the location field of the request header that the browser sends to the server.
Can a host header be set to an invalid value?
The Host header cannot be set to an invalid value. The Host header cannot be set after the HttpWebRequest has already started to be sent. The Host property can be used to set the Host header value to use in an HTTP request independent from the request URI. The Host property can consist of a hostname and an optional port number.
Is there a way to pass arbitrary host headers?
Another way to pass arbitrary Host headers is to use the X-Forwarded-Host header. In some configurations this header will rewrite the value of the Host header. Therefore it’s possible to make the following request. Many web application rely on the HTTP host header to understand “where they are”.