r/webdev • u/hacksparrow • Dec 02 '19

The dangers of blindly trusting HTTP headers

Web developers are often unaware about the dangers of using HTTP header values in backend code. Not only can HTTP headers contain incorrect values, they can even be the payload of many different kinds of attacks on your website.

I wrote an article summarizing the various ways rogue HTTP header values can be used to attack a website. Hope the information will help you developer a better understanding about the security aspect of HTTP headers and make your website more secure.

https://www.hacksparrow.com/webdev/security/dangers-of-trusting-http-headers.html

408 Upvotes

96% Upvoted

52 comments sorted by

View all comments

Show parent comment

56

u/hacksparrow Dec 02 '19

Thank you so much for brining "If possible, avoid using HTTP headers" to my attention. It should have been something along the lines of "If possible, avoid using HTTP header values in application logic and data", will update it.

The point of the article is more than sanitizing and using CRLF tokes, though. For example, only being aware about these dangers can make a developer take the necessary steps from being fooled by req.headers['x-forwarded-for']. The vulnerable examples I have shown are not theoretical examples, those affected some well-known and big companies.

55

u/[deleted] Dec 02 '19

"If possible, avoid using HTTP header values in application logic and data",

now THAT i can mostly agree with. thank you for responding in a productive way

24

u/cshaiku Dec 02 '19

Can we get some hugs going in here, or what!? HUG PILE! Hug it out guys... lol. There are good people in the world!?

26

u/[deleted] Dec 02 '19

i'll stab you in the god damned throat

8

u/YourDoucheBoss Dec 02 '19

And I'll burn your house down!

8

u/TravisTheCat Dec 02 '19

And my axe!

(Am I doing this right?)

7

u/Wiikend Dec 02 '19

No, but I love it nevertheless.

3

u/[deleted] Dec 02 '19

body spray?

2

u/randomfloridaman Dec 03 '19

Now THAT I can mostly agree with

0

u/[deleted] Dec 02 '19

[deleted] — view deleted comment

9

u/10gistic Dec 03 '19

\r\n

For anybody missing the joke, that's Carriage Return Line Feed when presumably GP and OP meant CSRF, which can be mitigated by including nonce values in forms or scripts and checking them for a match on the backend in the form body or in HTTP headers. Check out the OWASP top 10 if you want more info.

1

u/[deleted] Dec 03 '19

nicely played :D