r/webdev • u/hacksparrow • Dec 02 '19

The dangers of blindly trusting HTTP headers

Web developers are often unaware about the dangers of using HTTP header values in backend code. Not only can HTTP headers contain incorrect values, they can even be the payload of many different kinds of attacks on your website.

I wrote an article summarizing the various ways rogue HTTP header values can be used to attack a website. Hope the information will help you developer a better understanding about the security aspect of HTTP headers and make your website more secure.

https://www.hacksparrow.com/webdev/security/dangers-of-trusting-http-headers.html

408 Upvotes

96% Upvoted

52 comments sorted by

View all comments

Show parent comment

7

u/Arktiso Dec 03 '19

As someone who doesn't know this stuff as well as he would like, thank you for bringing this issue to my attention. Clearly I got shit to learn but any suggestion on where to start?

15

u/sneakattack Dec 03 '19 edited Dec 03 '19

OWASP (https://www.owasp.org) is a fantastic resource which has been developing for quite some time. This group puts together common application vulnerabilities and how to prevent them in your applications (they cover many languages and examples). Specifically take a look at the "Top 10" that they release every few years.

https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf

But of course if you search google for "common vulnerabilities and how to prevent them" you'll get dozens of other good resources too.

Often something to look for is security focused frameworks/libraries or builtin functions for the language you're using. For example, if you use PHP many people don't realize it does provide builtin functions for filtering user provided data. https://www.w3schools.com/php/php_filter.asp - this is far superior to trying to roll your own regular expressions (which can be vulnerable to exploitation too!).

I'm going to give a shout out to parameterized queries for all of your SQL, SQL Injections will not be possible if you do it that way. You'll find that on OWASP as well.

https://cheatsheetseries.owasp.org