Host Header Injection

Also Known As

TL;DR

Explanation

Many PHP applications use $_SERVER['HTTP_HOST'] to construct absolute URLs for password-reset emails, redirect targets, or canonical links. Because the Host header is fully controlled by the client (and can be spoofed or overridden via X-Forwarded-Host in proxied environments), an attacker can inject a malicious host to redirect password-reset links to their own server. Mitigations include maintaining an explicit allowlist of valid hostnames and validating $_SERVER['HTTP_HOST'] against it.

Common Misconception

Why It Matters

Common Mistakes

• Using $_SERVER['HTTP_HOST'] to build password reset or email verification links without validation.
• Trusting X-Forwarded-Host from reverse proxies without a strict allowlist.
• Generating absolute URLs in cached responses using the Host header — poisons the cache for other users.
• Not configuring a trusted_hosts or allowed_hosts list in the application or framework.

Code Examples

$resetLink = 'https://' . $_SERVER['HTTP_HOST'] . '/reset?token=' . $token;

$resetLink = 'https://www.example.com/reset?token=' . $token; // hardcode trusted origin

References

• ↗ https://portswigger.net/web-security/host-header
• ↗ https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/17-Testing_for_Host_Header_Injection

Tags

Related Terms