How to fix Host Header Injection

What an attacker can do

The concrete impact of leaving Host Header Injection unpatched.

How to fix Host Header Injection

5 ordered steps. Apply them in order — each builds on the previous.

1. 1

   Configure framework's allowed hosts list

   Most frameworks have built-in ALLOWED_HOSTS validation. Use it — requests with non-matching Host get rejected at the framework boundary.

   Django: ALLOWED_HOSTS. Rails: config.hosts. Express: configure trust proxy + custom middleware. Spring Boot: configure server.servlet.context.host.

   pythonStep 1

   # Django settings.py
   ALLOWED_HOSTS = ["app.example.com", "example.com", ".example.com"]
   USE_X_FORWARDED_HOST = True  # only if behind a trusted proxy
   USE_X_FORWARDED_PORT = True
   
   # Rails config/application.rb
   config.hosts << "app.example.com"
   config.hosts << "example.com"
   config.host_authorization = { exclude: ->(req) { req.path =~ /\.well-known/ } }

2. 2

   Use a configured base URL — never derive from Host header

   When constructing absolute URLs (password reset, OAuth callbacks, email links), use a configured BASE_URL env var. Don't read Host.

   Same URL for everyone. If you have multiple deployments (staging, prod), each gets its own BASE_URL.

   javascriptStep 2

   // ❌ Vulnerable
   function passwordResetUrl(token, req) {
     return `https://${req.headers.host}/reset?token=${token}`;
     // attacker sets Host: evil.com → URL points to evil.com
   }
   
   // ✅ Fixed
   const BASE_URL = process.env.BASE_URL;  // "https://app.example.com"
   function passwordResetUrl(token) {
     return `${BASE_URL}/reset?token=${token}`;
   }
   
   // In email-sending code:
   sendEmail(user.email, `Reset your password: ${passwordResetUrl(token)}`);

3. 3

   Reject ambiguous / multiple Host headers at the proxy layer

   Some attacks send `Host: evil.com\r\nHost: app.example.com` to confuse middleboxes. Reverse proxies should normalize.

   nginx by default rejects requests with multiple Host headers. Cloudflare, AWS ALB do the same. Verify your stack.

   nginxStep 3

   # nginx — explicit server_name + reject unknown hosts
   server {
       listen 443 ssl http2;
       server_name app.example.com;
       # ... routes ...
   }
   
   # Catch-all server block to reject other hostnames (return 444)
   server {
       listen 443 ssl http2 default_server;
       server_name _;
       ssl_certificate /etc/ssl/dummy.crt;
       ssl_certificate_key /etc/ssl/dummy.key;
       return 444;  # close connection without response
   }

4. 4

   Configure cache key to include Host (not just URL)

   If you have caching (CDN, app-level), include Host in cache key. Otherwise poisoned response from one Host value pollutes other Hosts.

   CloudFront: include Host in cache key behavior. nginx fastcgi_cache: include $host in cache key. Default is usually OK in single-tenant; verify if multi-tenant or multi-domain.

   nginxStep 4

   # nginx fastcgi_cache key includes Host
   fastcgi_cache_key "$scheme$request_method$host$request_uri";
   
   # Or for proxy_cache:
   proxy_cache_key "$scheme$request_method$host$request_uri";

5. 5

   Audit X-Forwarded-Host trust if behind multiple proxies

   If your stack is Client → Cloudflare → ALB → app, the X-Forwarded-Host can be set by any of them. Trust only the immediate proxy's headers.

   Configure framework to read only the rightmost trusted X-Forwarded-Host entry. Never trust an arbitrary count of forwards.

   javascriptStep 5

   // Express — trust proxy hop count, not 'true' (which trusts all)
   const app = express();
   app.set("trust proxy", 1);  // trust 1 proxy hop (e.g., your ALB)
   // Now req.hostname comes from X-Forwarded-Host of the first proxy only
   
   // Custom middleware — verify host against allow-list
   const ALLOWED = new Set(["app.example.com", "example.com"]);
   app.use((req, res, next) => {
     if (!ALLOWED.has(req.hostname)) {
       return res.status(400).send("Invalid host");
     }
     next();
   });