Direct answer
Applications and proxies should not blindly use untrusted host information to construct security-sensitive links or select privileged routes. Test the deployed proxy and application path with an owned test hostname.
Map the proxy and canonical host
Identify the public hosts, reverse proxies, forwarding headers and expected canonical base URL. Select an isolated test environment and assessor-controlled domain; avoid interfering with shared caches or production password reset mail.
Reference: OWASP WSTG: Host Header Injection.
Observe a safe generated link
Use a test account and a harmless function that constructs an absolute URL. With the owner's approval, compare the normal request with a request containing the controlled host value. Inspect the generated result and whether the proxy rejected or normalized the request.
- Do not send test links to real users.
- Record which header each trusted component receives.
- Avoid caching responses shared with other users.
Interpret the result
A reflected host string is not automatically account takeover. Establish whether the application uses it in a security-sensitive link or routing decision and whether an attacker could influence that request through the actual deployment path.
Retest canonical behavior
After enforcing trusted hosts or configured public origins, repeat normal and controlled-host requests. Confirm approved tenants and domains continue to work, and review forwarding headers only from explicitly trusted proxies.
Assessment limits
Different proxies, CDNs and virtual hosts can treat these headers differently. Avoid cache poisoning or password-reset testing against real users without separately approved safeguards.
Frequently asked questions
Does reflection of a host value prove account compromise?
No. Demonstrate the actual use of the value, deployment trust boundary and resulting impact using a controlled workflow.
Should every forwarded header be trusted?
No. Trust and sanitize proxy-supplied headers only at the configured boundary and verify the deployment path.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.