I am trying to correct a host header vulnerability from the server side as much as possible. The vulnerability is an HTTP host header attack. What I would like to do is only allow valid host headers to be passed through running applications. This way a host header that should be
example.com doesn't get passed down as
evil.com. There is a decent explanation of this vulnerability here: http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html.
I think URL Rewrite could assist with this, but I don't have a lot of experience with it so I am not sure. Has anyone hardened up their servers against this attack?
The server is setup with header bindings for allowed domains, though this will not stop a request containing a different host header value.
If I do figure out a way to filter, detect that the host header is incorrect, what type of response should be returned?