The question is very simple: can I trust the value of the Host header?
We are developing an application that serves some resources via HTTP and we wan't to have some private services and some others public.
We have internal domains such as "backoffice.xxxx.com" that can be only accessed internally, and we have other domains that can be accessed from anywhere.
To be more specific, this case is about an application that serves images. So we can have a path like "/pictures/xxxx" via GET and serves the image with that ID to everyone who wants to see it. But we also have mapped the "/pictures" path via POST to upload new images and we don't want anyone to upload pictures.
What we think is that we can use the Host header to validate the request and deny those who come from public domains (or just allow internal domains and deny any other).
What any other options do we have to validate this requests? (If the Host header is not safe enough).