Stop trusting X-Forwarded-Host

host-header-xfh

You trust X-Forwarded-Host from the client, so password reset links can be aimed at an attacker's domain. Strip it at the edge and set it yourself.

Why this matters

Your server trusts the X-Forwarded-Host header and uses it to generate links. An attacker can manipulate password reset emails and other system-generated links to point to their own domain, enabling token theft and phishing.

Your stack

CDN and edge

Cloudflare

Web servers

Nginx Apache

Frameworks

Express

Cloudflare

1 Cloudflare does not forward X-Forwarded-Host by default. If you see this, check your origin server configuration
2 Ensure your origin ignores or strips X-Forwarded-Host from incoming requests

Nginx

1 Strip the client-supplied X-Forwarded-Host header and set it yourself in the proxy configuration

nginx

# Set X-Forwarded-Host to the validated Host
proxy_set_header X-Forwarded-Host $host;

Express

1 Do not trust X-Forwarded-Host for URL generation. Use a configured base URL instead
2 If behind a trusted proxy, set trust proxy and validate forwarded headers

javascript

// Never use X-Forwarded-Host directly
// BAD: const host = req.headers['x-forwarded-host'];
// GOOD: use configured base URL
const BASE_URL = process.env.BASE_URL;

Does your app still have this?

Scan your domain