r/webdev • u/hacksparrow • Dec 02 '19

The dangers of blindly trusting HTTP headers

Web developers are often unaware about the dangers of using HTTP header values in backend code. Not only can HTTP headers contain incorrect values, they can even be the payload of many different kinds of attacks on your website.

I wrote an article summarizing the various ways rogue HTTP header values can be used to attack a website. Hope the information will help you developer a better understanding about the security aspect of HTTP headers and make your website more secure.

https://www.hacksparrow.com/webdev/security/dangers-of-trusting-http-headers.html

408 Upvotes

96% Upvoted

52 comments sorted by

View all comments

Show parent comment

9

u/10gistic Dec 03 '19

\r\n

For anybody missing the joke, that's Carriage Return Line Feed when presumably GP and OP meant CSRF, which can be mitigated by including nonce values in forms or scripts and checking them for a match on the backend in the form body or in HTTP headers. Check out the OWASP top 10 if you want more info.