Quantcast
Channel: Active questions tagged host-headers - Server Fault
Viewing all articles
Browse latest Browse all 30

htaccess to stop Host Header Injection

$
0
0

I have one application hosted on XAMPP, my application url is https://abc.example.com/pps/prd/, i have htaccess file at pps/prd/, with following code to stop Host header injection

RewriteEngine OnRewriteCond %{HTTP_HOST} !^([a-zA-Z0-9-_]{1,20}.){0,3}example.com$RewriteRule ^ - [F]

When i am hitting url https://abc.example.com/pps/prd/ with some other host in request header. it is working as expected i am getting 403 response from server.

My issue is when i am hitting url : https://abc.example.com/pps/prd (without trailing slash) with some other host like example123.com in request header, then i am getting response 301 moved permanently, and new request is getting initiated on host which i send in original request header in this case example123.com,https://example123.com/pps/prd/ , this should not happen.

htaccess is working as expected when URL is ending with '/' but not working without trailing '/'


Viewing all articles
Browse latest Browse all 30

Latest Images

Trending Articles





Latest Images