HTTP HOST header fake

AUG

Aug 22, 2008 by Mike Vandenberghe

Just a quick tip, if you use the HOST: header in your applications, remember, don't use it anywhere critical to security because it can be faked by someone with the know how. I know that there is some popular blogging software out there.... that had previously used $_SERVER['HTTP_HOST'] to include a file, if it is faked that is insecure.

Comments

Be the first to leave a comment on this post.

To leave a comment, please log in / sign up

Archive

RSS Feed

services overview

from the blog

Tips for Successful Email Campaigns

As you probably know, email recipients have become more and more sensitive to spam. When a recipient marks you as “spam” the major ISPs like gmail, yahoo, aol, comcast, msn, outlook and others will get notified and if they g...

on Jan 24, 2019 / 0 comments

Mosida Meats - Local Beef Delivery for Utah

We recently launched a new website for the Mosida Meats company. The farm in Elberta, Utah started primarily in dairy (milk - mmm good) and is now offering local delivery of their Grass Fed - Corn Finished beef. I was able to...

on Jul 31, 2018 / 0 comments