Questions tagged [header]
For questions regarding headers (like http headers) that give meta information about a payload being transmitted
156 questions
0 votes
1 answer
253 views
How exploitable is a redirect caused by sending a malicious X-Forwarded-Host header?
I have an Nginx reverse proxy that connects to different servers in the back-end according to the SNI. Recently it was pointed to me that if I add a header X-Forwarded-Host to something like https://...
8 votes
3 answers
4k views
Is the Origin header trustworthy for requests sent by the browser?
In another question, I implied that an application can check the Origin request header to determine where the request is from. I was under the assumption that the browser sets this to the origin of ...
- 35.6k
2 votes
0 answers
505 views
Why does Cross-Origin-Opener-Policy prevent opening links to the same-origin/domain when target="_blank" is used?
Let's say you serve a website with the header Cross-Origin-Opener-Policy: same-origin. This is a new header that, if I understood it correctly, completely separates a browsing tab/origin to prevent ...
- 1,325
4 votes
1 answer
485 views
Image loaded despite Cross-Origin-Embedder-Policy: require-corp
I have a web page with a Cross-Origin-Embedder-Policy: require-corp header. When I include an cross-origin image without CORP or CORS headers in the response, I expect the image to be blocked, because ...
- 35.6k
1 vote
1 answer
165 views
MIME Boundary field meaning & decoding in email header(mail.com web client)
As we know some important information can be found in MIME Boundary field in email headers. Such as the one described in this interesting link (Dates in Hiding Part 2 — Gmail MIME Boundary Timestamps) ...
- 31
1 vote
0 answers
455 views
What is the meaning and method of decoding the "X-UI-Sender-Class" in email header? [closed]
In an email forensic study, I want to know the meaning of the field "X-UI-Sender-Class" in email header and how can we decode this information. Note: the email is sent from mail.com Email ...
- 31
2 votes
0 answers
99 views
What is the client-security-token header typically used for?
I came across a site that allows the client-security-token in CORS requests: Access-Control-Allow-Headers: ..., client-security-token I have not found any request yet that includes this header. But ...
- 35.6k
1 vote
0 answers
115 views
What is the sense of the client's IP in a Host header? [closed]
In my webserver log files I sometimes find such entries: 185.30.14.116 [2024-09-14T07:56:57+02:00] 400 | HOST-HDR "185.30.14.116" | SRV _:80" | URI "/" So there is a request ...
1 vote
2 answers
154 views
Which security Headers for HTTPS?
I implement a server application in .NET. I just want to know which security headers I need to set if I use HTTPS. I know about the HttpOnly and SameSite Cookies. OWASP has a recommendation HTTP ...
- 369
6 votes
1 answer
975 views
If I'm using HSTS, can I skip the scheme from my CSP directives?
For various reasons, I need to shrink my CSP header a bit without degrading its effectiveness. I'm able to save some bytes by wildcarding some subdomains, but I'm also tempted to strip out all ...
- 163
0 votes
1 answer
1k views
Is it possible to disable or change sec-fetch-* HTTP headers?
I might have found a way to highjack an Oauth Flow, but the source server is responding with 403 errors when the Oauth request is sent with a Sec-Fetch-Dest HTTP header. Is there a way to alter or ...
- 1,512
0 votes
3 answers
6k views
Using HTTP header to transmit client certificate for mTLS
My client says their API traffic must take the path WAF -> Custom Firewall -> Backend API. Also, mTLS must be terminated after the traffic has gone through the network appliance. I have created ...
- 101
0 votes
1 answer
649 views
CRLF in HTTP/2 header value
I am attempting to inject a carriage-return + newline in a HTTP request header value. My understanding is that this is possible with HTTP/2 and HTTP/3. However, when I send a request with Burp I get ...
- 35.6k
0 votes
1 answer
187 views
cURL not returning status 302 after correct login for Hack the Box Machine 'Crocodile'
cURL is returning a 200 status code after correct login. The common response code after user login should be 302. Why am I not receiving this status code? All information is provided below. #!/usr/bin/...
user303027
0 votes
1 answer
386 views
Is a random unknown HTTP request header 'Host' that is reflected in the HTTP response 'Location" header (3xx) a open redirect or DNS rebinding?
If I send an unknown domain name in the HTTP request header 'Host' to a webserver and the webserver responds with a HTTP status code 301/302 (redirect) along with a HTTP response header 'Location' ...
- 7,715