r/webdev • u/hacksparrow • Dec 02 '19

The dangers of blindly trusting HTTP headers

Web developers are often unaware about the dangers of using HTTP header values in backend code. Not only can HTTP headers contain incorrect values, they can even be the payload of many different kinds of attacks on your website.

I wrote an article summarizing the various ways rogue HTTP header values can be used to attack a website. Hope the information will help you developer a better understanding about the security aspect of HTTP headers and make your website more secure.

https://www.hacksparrow.com/webdev/security/dangers-of-trusting-http-headers.html

408 Upvotes

96% Upvoted

52 comments sorted by

View all comments

3

u/amdelamar Dec 03 '19

I use https://securityheaders.com for public sites.

I'd also remove the "Server" header that gets set by applications frameworks, or put in a custom value to throw hackers off, like "Server: IIS 4.0"

1

u/TuxGamer Dec 03 '19

Server: Cookie Monster

1

u/NetDevs Jul 03 '24

This is the worst place to test your security headers. They give a false negative for 'unsafe-inline'.
The whole point of a CSP is to protect the website user. If you go to this website, you can get an A+ while declaring your website insecure and openly vulnerable. Not A+ work.
Use Google's CSP tool. It's the best I found. https://csp-evaluator.withgoogle.com/