Reverse Proxies

Host Header Trust Can Turn Application URLs Into Attacker Input

A web application can serve the correct page, validate the correct account, and still emit a security-sensitive link pointing at a domain controlled by somebody else. The failure often begins with a value that looks operational rather than privileged: the HTTP host presented with the request. Modern deployments make host handling deceptively complex. A browser sends authority information, an edge proxy may rewrite it, another proxy may add a forwarding header, and the application framework eventually exposes a convenient property representing the apparent host. That property is useful for routing and URL generation. It is dangerous when the application treats it as an authenticated statement about its own public identity.