What is Host Header Injection?

The HTTP Host header names a request's target host and allows multiple websites to share an IP address. HTTP/2 and HTTP/3 carry the equivalent information in :authority. Host header injection occurs when a proxy or application uses a client-controlled host for security-sensitive URLs, routing, caching or trust decisions.

What does the Host header do?

A web server chooses a virtual server using the host, while TLS configuration commonly uses SNI earlier. Frameworks also use the host to generate absolute links and redirects. Behind reverse proxies, headers such as X-Forwarded-Host and Forwarded appear. They are trustworthy only when a known proxy sets them itself and removes client-provided variants reliably.

How is it abused?

A password-reset function may generate https://{Host}/reset?token=.... If it accepts attacker.example, it sends a valid token in a link to that foreign domain. Other applications redirect unknown hosts, load assets from them, select tenants or route to internal backends. Attackers vary host, port, absolute request targets and multiple forwarding headers to influence different components.

What impact is possible?

What role do forwarding headers play?

A reverse proxy may need to pass the original host to a backend. A blanket setting to “trust all proxies” lets a direct client choose X-Forwarded-Host. Proxy chains may append or overwrite values, while application and WAF may select different positions. Architecture must define which proxy is trusted, which headers it sanitizes and which single value the backend uses.

How is Host header injection prevented?

1. Accept explicitly configured hosts only at the first reachable proxy and reject unknown hosts.
2. Configure public base URLs for reset, invitation and confirmation links instead of deriving them from requests.
3. Remove forwarding headers from external clients and accept values only from known proxy addresses.
4. Never use a host or internal hostname for authentication or authorization.
5. Cache keys and tenant selection must consistently include the validated canonical host.
6. Provide a non-sensitive default virtual host and block direct backend access.

Code example: do not derive reset links from the Host header

Vulnerable:

$resetUrl = $request->getSchemeAndHttpHost()
    . '/password/reset?token=' . urlencode($token);

Safer: use a validated, explicitly configured public base URL.

$resetUrl = rtrim(config('app.url'), '/')
    . '/password/reset?token=' . urlencode($token);

The edge proxy should also reject unknown hosts. A fixed base URL protects link generation, but does not replace consistent Host validation across proxy, application and cache.

How is it tested?

Testers vary Host, port, absolute request target, :authority and relevant forwarding headers alone and together. They observe links, redirects, caches, email and routing. Reset tests use only controlled accounts and domains. Reflection of the host is merely a clue; a security-relevant effect or broken trust boundary establishes impact.