# HOST header injection

**URL:** <https://discourse.haproxy.org/t/host-header-injection/4994>\
**Category:** Help!\
**Created:** [March 23, 2020, 2:57pm UTC](https://discourse.haproxy.org/t/host-header-injection/4994 "2020-03-23T14:57:43Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![arlinux](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@arlinux](https://discourse.haproxy.org/u/arlinux)\
**Post date:** [March 23, 2020, 2:57pm UTC](https://discourse.haproxy.org/t/host-header-injection/4994/1 "2020-03-23T14:57:43Z")

</div>

Hello,

I have HA-Proxy version 1.8.19 running.

```
curl -I -H "Host:www.bing.com" http://www.mydomain.net
HTTP/1.1 301 Moved Permanently
Content-length: 0
Location: https://www.bing.com/

```

Could someone advise on how to avoid such HOST header injection ?

Thanks!  
Ash

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [March 23, 2020, 7:12pm UTC](https://discourse.haproxy.org/t/host-header-injection/4994/2 "2020-03-23T19:12:30Z")

</div>

What header injection? You are making a normal HTTP request and specifying a specific Host header.

---

<div class="post-metadata">

**Author:** ![arlinux](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@arlinux](https://discourse.haproxy.org/u/arlinux)\
**Post date:** [March 24, 2020, 2:31pm UTC](https://discourse.haproxy.org/t/host-header-injection/4994/3 "2020-03-24T14:31:50Z")

</div>

Hello Lukas

Please refer:

> **[HOST HEADER INJECTION ATTACK](https://medium.com/@rockerramg94/host-header-injection-attack-6cf4ffeb5a03)**
>
> The host header specifies which website or web application should process an incoming HTTP request. The web server uses the value of this…

  

> **[What is a Host Header Attack? | Acunetix](https://www.acunetix.com/blog/articles/automated-detection-of-host-header-attacks/)**
>
> Two major attack vectors that a host header attack can enable are web-cache poisoning, and abuses of alternate channels for conducting sensitive operations

```
curl -I -H "Host:www.bing.com" http://www.mydomain.net/landingpage

This gets Location: https://www.bing.com/landingpage

```

Is there a possible to keep validate HOST HEADER Injection is haproxy or any other config suggestions that can avoid ?

Many Thanks!  
Ash

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [March 24, 2020, 2:57pm UTC](https://discourse.haproxy.org/t/host-header-injection/4994/4 "2020-03-24T14:57:33Z")

</div>

Validate against what? A static list of yours? Sure, just use normal ACLs.

---

<div class="post-metadata">

**Author:** ![arlinux](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@arlinux](https://discourse.haproxy.org/u/arlinux)\
**Post date:** [March 26, 2020, 4:42am UTC](https://discourse.haproxy.org/t/host-header-injection/4994/5 "2020-03-26T04:42:24Z")

</div>

Do you mean - If Host ! [mydomain.net](http://mydomain.net) - then deny ?

Could you please post here snippet of ACL’s and validation…

Thanks,  
Ash

---

<div class="post-metadata">

**Author:** ![arlinux](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@arlinux](https://discourse.haproxy.org/u/arlinux)\
**Post date:** [March 26, 2020, 6:21am UTC](https://discourse.haproxy.org/t/host-header-injection/4994/6 "2020-03-26T06:21:19Z")

</div>

Hello Lukas,

Tried this and it works. Do you foresee any other type of web-request’s issues with this config ?

` http-request deny if !{ req.hdr(host) -i -m end mydomain.net }`

Appreciate your help!

Best,  
Ash

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [March 26, 2020, 11:03am UTC](https://discourse.haproxy.org/t/host-header-injection/4994/7 "2020-03-26T11:03:01Z")

</div>

You probably want to prefix a dot at the domain, otherwise this would also other domains ending with that, like `thatsmydomain.net` for example.

But what makes sense in your situation really depends on what issue you are trying to solve, which is unclear to me at this point.