Stop building redirects from Host

host-header-redirect

Redirect URLs are built from the Host header, so a crafted request points Location somewhere you do not control. Hardcode your canonical domain.

Why this matters

Your server builds redirect URLs from the Host header. An attacker can only manipulate their own request — the redirect affects only the attacker's session, not other users.

Your stack

Web servers

Nginx Apache

Frameworks

Express

Nginx

1 Use a hardcoded domain name in redirect directives instead of relying on $host or $http_host

nginx

# BAD: redirect uses client-supplied Host
# return 301 https://$host$request_uri;

# GOOD: redirect uses hardcoded domain
return 301 https://www.example.com$request_uri;

Express

1 Use a configured base URL for all redirects instead of req.headers.host

javascript

const BASE_URL = process.env.BASE_URL || 'https://www.example.com';

// BAD: res.redirect(`https://${req.headers.host}/dashboard`);
// GOOD:
res.redirect(`${BASE_URL}/dashboard`);

Does your app still have this?

Scan your domain