Questions tagged [header]
The header tag has no usage guidance.
1
vote
1answer
50 views
Should HTTP Security headers be configured for all servers?
I recognise the importance of configuring HTTP security headers (X-Frame-Options, X-XSS-Protection and X-Content-Type-Options) for web servers
(and other internet facing servers such as loadbalancers)....
0
votes
0answers
52 views
Where should I look for 'Location' header malicious redirect? Linux, php [duplicate]
My site was hacked and now it responses with 'Location' header redirecting to the malicious site, but does this only for mobile clients. I wasn't able to find the malicious code yet and I'd like you ...
1
vote
1answer
53 views
Is there an any risk with HTTP header value reflection?
This website has a header in the request (If-None-Match) and whatever you set the value to for it, the response will contain a header (ETag) with the value of the If-None-Match header.
I understand ...
2
votes
2answers
93 views
Content Security Policy Header not stopping attack
I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags ...
0
votes
0answers
15 views
Using Referer/Origin request header to prevent CSRF [duplicate]
I'm testing a web application checking the Origin or Referer request header as a CSRF prevention mechanism.
I could not find a way to bypass these checks and they seem to be implemented reasonably ...
0
votes
0answers
76 views
Prevent iframe from inheriting CSP headers
I have an angular 6 application where Content Security Policy headers are applied via a meta tag.
On one of the pages there is an iframe for which those headers should not be applied.
For some ...
0
votes
1answer
58 views
Getting confusion that this responce indicate CORS vulnerability
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 12
Connection: close
Date: Tue, 25 Sep 2018 12:59:56 GMT
x-amzn-RequestId: xxxxxxxxxxx
Access-Control-Allow-Origin: *
Access-Control-...
1
vote
1answer
104 views
Web-Application with CORS Origin: * using authorization header
As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote:
When responding to a credentialed request, the server must specify an
...
3
votes
1answer
98 views
Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?
I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
1
vote
1answer
141 views
Suspiscious HTTP request to nginx server in server log, what is it?
I have an nginx server running an instance of and express/nodejs server.
I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
15
votes
2answers
3k views
How did this email list a fake recipient? [duplicate]
My friend recently received a suspicious email for an iTunes gift card purchase from "Apple Store" with a header that displayed a fake "To:" address for orders@apple-store.com.
Unsurprisingly, this ...
2
votes
1answer
61 views
When implementing CORS, should I check for a correct HOST header in my webapp?
I have a backend web server that serves an API (over HTTPS) to a frontend browser client on a different subdomain. It uses CORS to allow this.
The CORS spec directs you to not send the CORS headers ...
1
vote
1answer
452 views
X-Frame-Options header on redirect
I have several web applications running on my server (Debian 8 running Apache). One of my customers wants to improve the security of his app, after having some security audits carried out by a third-...
1
vote
1answer
184 views
Damage of a leaked ETag
I've read multiple times that leaked ETags from Webservers are considered an information leakage vulnerability.
For example in the server response headers:
ETag: X/"1234-56789"
But I have not found ...
1
vote
1answer
416 views
How to bypass response Location in order to obtain content XSS?
In some basic steps:
POST Request containing a photo with multipart/form-data.
HTTP/1.1 302 Found respond with redirect back to formular
Redirect to initial formular.
In case 1 we are able to ...
0
votes
1answer
158 views
CSP header default-src: data:
I am testing CSP header implementation. The implemented header value is:
Content-Security-Policy: default-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-...
0
votes
0answers
25 views
Implementation of HTTP Public Key Pinning [duplicate]
I am trying to implement HTTP Public Key Pinning and i am having some issues with the certificate. I followed this guide to create the HTTP Response in IIS:
https://www.namecheap.com/support/...
0
votes
0answers
130 views
Is Paypal's Stateless CSRF no longer Express Compatible
My question is on paypals csrf stateless solution: https://github.com/krakenjs/jwt-csrf
This csrf solution obliges the user to put the token in the header. Is there a security reason why the token ...
1
vote
1answer
318 views
Application/Octed-Stream header for XML file
My application when downloading XML file returns headers:
Content-Type: Application/Octed-Stream
Content-Disposition: attachment; filename=file.xml
Is this behavior correct form security point of ...
3
votes
1answer
529 views
Is host header injection possible without cache or password reset?
I am a beginner in security and reading about host header injection. I tested an application for this vulnerability and it is possible there for some request, but the developer implemented no-cache, ...
5
votes
1answer
129 views
Is it worth verifying the request hostname in API-to-API communications?
When authenticating from a browser application to an API layer, you can verify the request origin for CORS requests. I'm aware that this is primarily to prevent CSRF attacks. It doesn't prevent an ...
0
votes
1answer
3k views
Check for insecure CORS settings with cURL
I'm trying to verify the CORS settings of a website using cURL. The following command should let me check whether the CORS settings can be considered as secure or if requests may be made across ...
0
votes
1answer
158 views
What is an exploitation schema in this XSS attack? [duplicate]
Basically, I've found an XSS injection by changing the payload with the X-Forwarded-Host header, since its value is reflected in the document and is not sanitized.
An example, this is the document ...
1
vote
0answers
791 views
Is CSRF token managed through HTTP headers safe?
I'm building a CSRF protection on my application, and I am wondering on the best (or let's say least unsecure) way to transmit my CSRF token. The application enforces HTTPS, with TLS1.2.
When I ...
3
votes
1answer
407 views
X-Content-Type-Options without content-type
X-Content-Type-Options helps to protect against attacks that take advantage of the browser trying to interpret HTTP responses with an incorrectly stated Content-Type.
But what happens when the HTTP ...
1
vote
2answers
145 views
User name and password is passed in custom headers
Is it safe to pass username and password in two separate custom header tags in Web services/Web application Post request over https.
How is it different from using from Authorization header.
Which ...
0
votes
1answer
139 views
HTTP Security header implementation
Does any one know if:
X-Frame-Options
X-XSS-Protection
X-Content-Type-Options
Content-Security-Policy
are for HTTP and:
Strict-Transport-Security
Public-Key-Pins
are for HTTPS?
What I mean is ...
4
votes
2answers
5k views
Does the X-Permitted-Cross-Domain-Policies header have any benefit for my website if I'm not using Adobe products?
OWASP says the X-Permitted-Cross-Domain-Policies security header gives web clients "permission to handle data across domains". It specifically states that Adobe's Flash Player and Acrobat PDF Reader ...
0
votes
1answer
1k views
PCI Consideration for HTTP Headers? [closed]
Recently, some of our servers were being flagged for not implementing proper HTTP headers in a Qualys scan.
One of the sites that I visit regularly - http://pentestit.com has some good HTTP headers ...
3
votes
3answers
2k views
What does the POST data of HackBar (Firefox add-on) do?
What does the POST DATA Feature of Hackbar (Addon of Firefox )do ?
If I am checking for XML XXE vulnerability i use it .But what does it do by POSTing some data ?
If I want to repeat the same thing ...
1
vote
1answer
560 views
Host header attacks: Possible exploits
We have an API server hosted with amazon elb. The server has only one virtual host and hence it doesn't enforce Host header. But if we manually add a Host header along with the request with a valid ...
3
votes
1answer
742 views
X-Frame-Options Absent but cant load the page in iframe
I am trying to find the reason that a certain webpage is not getting iframed even when X-Frame-Options header is absent.
Observation:
When I write an HTML with iframe tag pointing to the URL and save ...
1
vote
1answer
756 views
How does this header handling work with CloudFlare? [closed]
Assuming I have my website which uses CloudFlare, can I set the X-Forwarded-For with another IP so it gets forwarded to my server?
I'm trying to do it with a tool and the website prints the IP I've ...
2
votes
0answers
463 views
HTTP header: Range: bytes=XXX and possible XSS?
I'm currently experimenting with the "Range: bytes=XXX" HTTP header. Regardless the possibility of using it for the so called "Apache Killer" DoS attack (unpatched Apache version, etc), is it possible ...
1
vote
2answers
113 views
How to prevent emails where sender has been spoofed? [closed]
I have been at the receiving end of some classic spoofed emails where the sender sends an email looking like it has come from a senior executive of the company. Of course, these are always asking for ...
1
vote
1answer
280 views
Proxy not rejecting illegal host header when coming from my VM provider's network
I have a django app hosted on a linode VM, proxied by nginx on that same VM.
In my nginx config I have a block to deny bad host header requests:
## Deny illegal Host headers
if ($host !~* ^(mydomain....
1
vote
1answer
76 views
What should content-type be of encoded page?
A security review replied that we have an incorrect content-type.
There was no content-type stated so it defaulted to text/html.
However the page was just encoded - Fiddler gives the option to ...
2
votes
1answer
802 views
Bypassing x-frame options possibility discussion
This has something to do with a different post I made:
Other post
While researching this a bit further I found the following blogpost: blog elev
As I understand it this guy reads all content of a ...
0
votes
1answer
125 views
Host Injection Vulnerability Successful HTTP codes? [closed]
I am trying to exploit Host Injection Vulnerability of a website.
If I change the host or add another host, what all are the HTTP response codes that will tell me about a successful HTML Host ...
1
vote
1answer
135 views
Does using PHP headers during login make the form vulnerable to attacks?
I didn't think so, but upon reading online it seems this type of code is vulnerable as I'm not ending with exit(); and could therefore be exploited by redirecting or changing the contents of the ...
5
votes
1answer
2k views
Content-type validation in REST APIs
I'm trying to wrap my head around, why it is advised to validate the content-type, sent by a client to a REST API.
OWASP states in their REST Security Cheat Sheet:
When POSTing or PUTting new data,...
1
vote
0answers
108 views
What HTTP headers do you generally suggest to use? [closed]
I feel like there's a lot of variation in the suggested HTTP headers.
Commonly I see suggestions for:
HTTP Strict Transport Security
Content Security Policy
X-Frame-Options (Same Origin)
X-Xss-...
0
votes
0answers
537 views
Can you spoof the entire x-forwarded-for to contain a certain value?
I saw many questions regarding x-forwarded-for but I didn't find one regarding my special case. My case is described as follows:
I have 2 types of requests received by my server.
Type 1 are requests ...
7
votes
1answer
3k views
Vary: origin response header and CORS exploitation
Recently PortSwigger (guys behind Burp Suite) came up with a blog post discussing the security risks associated with CORS mis-configurations.
http://blog.portswigger.net/2016/10/exploiting-cors-...
6
votes
2answers
2k views
For which content types is it recommended to set X-XSS-Protection header?
One may probably suggest setting this header for all responses from a web server (I am thinking of value="1; mode=block").
However, does it make sense to set it when serving, say, images? CSS files? ...
8
votes
1answer
5k views
Security Headers for a web API
I just got a setup, a golang web api behind a caddy server that has HTTPS by default via Let's Encrypt, the server proxies all requests to the web api. So I went around to test my webserver "security" ...
147
votes
4answers
21k views
Which security measures make sense for a static web site?
I have a static web site. Users cannot log in or perform any other actions. Which of the common HTTP security measures make sense for my site?
Do I need any of these?
HTTPS
Strict transport security
...
3
votes
2answers
4k views
How can I have received this email?
I usually delete SPAM, but this email caught my attention:
As you can see, in "To:" field there is spammer account, but I thought: it's not important, in message header there must be some hidden "for"...
2
votes
3answers
2k views
TLS to secure Basic HTTP Auth
Basic Auth, including Bearer tokens, depend on using TLS to prevent eavesdroppers from getting at your sensitive credentials or tokens. But I think there is an Elephant in the room that nobody talks ...
2
votes
1answer
1k views
How can the Origin header be used for CSRF prevention if Firefox doesn't send it for same origin requests or requests from data URIs?
I'm planning to use synchronizer tokens for CSRF prevention, but OWASP recommends checking the referrer and origin headers too. I've been trying to figure out the correct logic for this, but my ...
