If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
Yes it is possible, but only in certain cases. There are two general classes of Header Injection attacks that I am aware of:
One is a Man-in-the-Middle (MITM) attack where someone is intercepting your traffic to inject header info. HTTPS connections protect against these.
The second is a Cross-Site Script (XSS) attack. These are attacks against an application level vulnerability where a user of a website can use his input to affect the way that headers are dynamically created for other users. With XSS attacks, you change the way the server parses what it's sending you before it is encrypted for transmission; thus the content can be modified.
An example of this vulnerability might look like:
<?php ... // functions and SQL to collect $resultHeader and $resultHTML parameters from your database. $header = buildHeader($resultHeader); $html = buildHTML($resultHTML); echo $header; echo $html; ?>
Since the buildHTML() function processes before the $header variable is written to the page, a PHP injection could rewrite $header before it is echoed.
For all protocol level attacks, that is HTTP splitting and cache poisoning using headers injections via bad HTTP syntax parsing (HTTP Smuggling), the TLS protection would not protect you. HTTP protocol is encapsulated in the TLD/SSL layer, but at the end the parser will read an HTTP message, as if no encryption was done. The TLS layer protects the message while it's traveling, not when an HTTP actor is parsing it.
At least the TLS adds some complexity on the attacker side, where a tool supporting TLS (like openssl_client) has to be used and not very simple socket connections tools like telnet or netcat. Nothing that cannot be done.
There is also headers injection via application errors, usually via CRLF injections on query arguments. Here again TLS protection adds very few protections.