What Are Host Header Attacks?
Host header attacks exploit applications that trust the HTTP Host header — a value the client
fully controls. Developers often assume it reflects their real domain, then use it to build
absolute URLs, reset links, or cache keys. Because an attacker can set it to anything, that trust
turns into poisoned links, hijacked password resets, and
cache poisoning.
How does the attack work?#
The Host header (and relatives like X-Forwarded-Host) arrives with every request and is
attacker-controllable. If the app reflects it:
Password reset builds: https://<Host>/reset?token=SECRET
Attacker sets Host: evil.example
Victim's email link: https://evil.example/reset?token=SECRETThe victim gets a genuine email from the real service, but the link — and the reset token — points at the attacker. This password reset poisoning is the most damaging case, but the same trust enables web cache poisoning and routing to internal virtual hosts.
Where does trusting the Host header bite?#
Use of Host | Attack |
|---|---|
| Password reset links | Token sent to attacker (account takeover) |
| Absolute URLs in email | Phishing via trusted sender |
| Cache keys | Cache poisoning |
| Routing / virtual hosts | Reaching unintended back-ends |
How do you prevent it?#
- Do not build URLs from the
Hostheader — use a configured, canonical domain. - Validate
Hostagainst an allowlist of expected domains; reject unknown values. - Ignore
X-Forwarded-Hostunless it comes from a trusted proxy you control.
Host header attacks are an input-validation failure with account-takeover potential. More at the Web Security hub.
Frequently asked questions#
What is a host header attack?
A host header attack exploits an application that trusts the client-supplied HTTP Host (or related) header. Because that header is attacker-controllable, an app that reflects it into links, emails, or cache keys can be tricked into generating malicious URLs — most damagingly, password-reset links pointing at an attacker’s domain.
Why is password reset poisoning so dangerous?
If a reset email builds its link from the Host header, an attacker can request a reset for a victim while injecting their own domain. The victim receives a legitimate-looking email whose reset link sends the token to the attacker. Clicking it hands over account access, making this a direct account-takeover path.