Question 1

What is Host header injection?

Accepted Answer

Host header injection happens when an application builds URLs, links, or cache keys from the incoming Host (or X-Forwarded-Host) header without validating it. Because the client controls that header, an attacker can make the server emit links that point at an attacker-controlled domain.

Question 2

How does it poison a password reset?

Accepted Answer

If the reset link is built as https://<Host>/reset?token=..., an attacker who sets Host to evil.com sends a reset request for the victim. The victim receives an email with a link to evil.com carrying their real token; clicking it or loading its resources leaks the token to the attacker, who can then reset the password.

Question 3

How do I prevent Host header injection?

Accepted Answer

Never build absolute URLs from request headers. Use a hard-coded or configured canonical base URL, validate Host against an allowlist and return 400 on mismatch, and don't trust X-Forwarded-Host unless it comes from your own proxy. Frameworks like Django (ALLOWED_HOSTS) and Rails (config.hosts) provide this natively.

Host Header Injection

Challenges

Frequently Asked Questions