Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [header]

For questions regarding headers (like http headers) that give meta information about a payload being transmitted

Filter by
Sorted by
Tagged with
0 votes
1 answer
91 views

Is it possible to disable or change sec-fetch-* HTTP headers?

I might have found a way to highjack an Oauth Flow, but the source server is responding with 403 errors when the Oauth request is sent with a Sec-Fetch-Dest HTTP header. Is there a way to alter or ...
user2284570's user avatar
  • 1,472
0 votes
3 answers
259 views

Using HTTP header to transmit client certificate for mTLS

My client says their API traffic must take the path WAF -> Custom Firewall -> Backend API. Also, mTLS must be terminated after the traffic has gone through the network appliance. I have created ...
chriaass's user avatar
  • 101
0 votes
1 answer
132 views

CRLF in HTTP/2 header value

I am attempting to inject a carriage-return + newline in a HTTP request header value. My understanding is that this is possible with HTTP/2 and HTTP/3. However, when I send a request with Burp I get ...
Sjoerd's user avatar
  • 30.8k
0 votes
1 answer
71 views

cURL not returning status 302 after correct login for Hack the Box Machine 'Crocodile'

cURL is returning a 200 status code after correct login. The common response code after user login should be 302. Why am I not receiving this status code? All information is provided below. #!/usr/bin/...
Michael Sodeke's user avatar
0 votes
1 answer
167 views

Is a random unknown HTTP request header 'Host' that is reflected in the HTTP response 'Location" header (3xx) a open redirect or DNS rebinding?

If I send an unknown domain name in the HTTP request header 'Host' to a webserver and the webserver responds with a HTTP status code 301/302 (redirect) along with a HTTP response header 'Location' ...
Bob Ortiz's user avatar
  • 6,665
1 vote
1 answer
523 views

Should the use of the HTTP 'ETag' header be avoided for security and privacy concerns?

I'm looking into the risks associated with the use of the HTTP 'Etag' header and found the following relevant information already. Information Disclosure (inodes) This article titled: "...
Bob Ortiz's user avatar
  • 6,665
1 vote
1 answer
133 views

Which response headers for HTML snippets?

I have a web application that retrieves HTML snippets from the server and places them on the page, using JavaScript. The server responds with a small part of a HTML document. What Content-Type header ...
Sjoerd's user avatar
  • 30.8k
1 vote
1 answer
118 views

Verbose Headers/Information Leakage via HttpResponse Headers vs fingerprinting via named headers

I understand that a header like X-Powered-By can reveal details about the operating environment that can be used to find known vulnerabilities because you often get the language and compiler/...
JoSSte's user avatar
  • 149
1 vote
1 answer
528 views

Are CORS headers useless?

It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
Vitor Figueredo Marques's user avatar
0 votes
1 answer
177 views

Why some ransomware adds padding to headers

Does anyone know why some ransomware families (e.g. Cuba but also Phobos if I am not mistaken) pad the file header to get to 1024 bytes? I mean what would be a reason for the ransomware developer to ...
Questions123's user avatar
0 votes
1 answer
294 views

How to reliably identify referrer on client browser?

Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)? Referrer header will not work because the ...
Adam Thompson's user avatar
0 votes
1 answer
231 views

Is API client responsible for HTTP security headers?

When client (Postman for example) is making the request to server, is the client responsible for including the HTTP security headers in the request? Or is the server responsible for defining these ...
Ewidence's user avatar
0 votes
0 answers
20 views

IP address from headers (Gmail/outlook mobile app) [duplicate]

My question isn't a duplicate. I know that the IP is leaked in the computer desktop version of outlook. But from I'm able to tell, the mobile version didn't leak it. I need to make sure that I'm right ...
lalachka's user avatar
  • 101
0 votes
0 answers
503 views

The most safe combination for Content Security Policy

I need high security for my app, so I have to add security headers for my views. However, I'm not entirely sure I understood the CSP header correctly (specifically its parameters). Is my combination ...
Szyszka947's user avatar
3 votes
1 answer
581 views

Are HTTP security headers only for web browsers?

There are some HTTP security headers in the world of cyber security of web applications. These are e.g.: X-Content-Type-Options X-Frame-Options Content-Security-Policy Referrer-Policy Strict-...
Hasan's user avatar
  • 519
2 votes
1 answer
167 views

Does a proper Email ALG (i.e. Email-Proxy) alter/remove the local Email-Header information?

Does a proper Email ALG (i.e. Email-Proxy) alter/remove the local Email-Header information so the recipient does NOT get information about the locally used IP addresses? Example: Received: from mail....
Christina's user avatar
16 votes
5 answers
8k views

Is having the name of web server software in HTTP response header a serious problem?

How serious a security problem is it to have the name of the web server in the HTTP header (Apache, Nginx etc.)? I am discussing this with a system administrator and he told me that deleting version ...
cipisek's user avatar
  • 162
1 vote
1 answer
131 views

Security headers: Are they needed on subsequent requests (eg. Scripts, Images) after they have been sent on the main HTML request?

I had a discussion with PenTesters at my company today, who have said that security headers, like for example Content-Security-Policy, Strict-Transport-Security, Referrer-Policy and Permissions-Policy,...
Michael Salivon's user avatar
3 votes
1 answer
684 views

Is there a reason for a server-side limit on the number of HTTP headers allowed for each request?

The security team at my company has set a limit on the number of headers a HTTP request can contain (not header size, but an actual hard count limit on the number of headers). A vendor has added a few ...
Jessica's user avatar
  • 133
1 vote
1 answer
3k views

Why set max-age=0 if no-store is already set?

A result of a recent pentest suggested that the HTTP Cache-Control Header max-age=0 should be set when no-store is set. As I understand cache control, no-store is the strictest we can set; the page ...
Druckles's user avatar
  • 153
0 votes
0 answers
77 views

Is different X-Forwarded-For values per site an indicator for something malicious?

I am using a mobile ISP to access the internet. I noticed something really weird: most sites (e.g. www.whatismyip.com, https://www.iplocation.net/http-browser-header) report my IP as let's say IP A: ...
pkExec's user avatar
  • 163
1 vote
0 answers
303 views

Headers X-XSS-Protection issue

I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header ...
santosh baruah's user avatar
-1 votes
1 answer
1k views

CORS attack using authentication token [closed]

I found a website which is vulnerable to cors.(https://portswigger.net/web-security/cors) GET /api/requestApiKey HTTP/1.1. Host: vulnerable-website.com. Origin: https://evil.com. AUTHENTICATION: ...
Cyber World's user avatar
1 vote
0 answers
186 views

Should I set "Ignore" cookie headers flagged from Akamai WAF or change its severity to Informational?

I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity. Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag. The question here is ...
offsecgirl's user avatar
2 votes
1 answer
448 views

HTTP and HSTS Web Server

If I have HSTS enforced on a web server with HTTPS 443, but HTTP port 80 is still open, does this make HTTP still accessible, or only for the first time before it's added to the browser HSTS list? I ...
Sjim49's user avatar
  • 23
0 votes
1 answer
762 views

Url only works from the browser it is generated from. Copying it into a Curl Command fails, and gives a 403 error. How can I fix this?

I am doing some web scraping for streaming files, .m3u8 mime type. In this particular instance, I can't create a functional request that does not end up with a 403 Forbidden error. How to reproduce: ...
Jannies - They do it for free's user avatar
3 votes
3 answers
840 views

HttpResponse Headers Information Leakage on Server Error (Verbose Headers)

In the past I have dealt with security issues related to Default Service Banners/Verbose Headers/Information Leakage via HttpResponse Headers. These issues are quite common, and usually look ...
MattyMerrix's user avatar
1 vote
2 answers
759 views

Do relative paths mitigate HTTP Host Header attacks?

I have been researching http host header attacks. There are many examples such as <a href="https://_SERVER['HOST']/support">Contact support</a>. Why would anyone use an absolute ...
Paul Blackburn's user avatar
0 votes
1 answer
3k views

Cookies Vs Headers For REST API User Authentication Token

I'm working on a small rest api project with user authentication. But I'm wondering whether I should store the users authentication token in a header or a cookie. The general idea is as follows: User ...
Bryan's user avatar
  • 3
1 vote
1 answer
2k views

Modifying UserAgent by a proxy?

For learning and testing purposes I'd like to change the UserAgent in the HTTP header. In the desktop Firefox it is simple: there is an add-on for this task. But on android... it is impossible. I ...
my name is Jack's user avatar
4 votes
2 answers
869 views

Is mime-sniffing still something to protect against with modern browsers (with X-Content-Type-Options)?

I have read about X-Content-Type-Options and it says often that it protects against IE mime sniffing problems. I am wondering if in 2021 it is still valid and a problem for modern browsers? In other ...
Ilya Chernomordik's user avatar
0 votes
1 answer
327 views

Sending Post Requests Server to Server

I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
user1609391's user avatar
1 vote
2 answers
400 views

Is there way to know what headers can be accepted by HTTP server?

Imagine that there is server required authentication for getting an access to some endpoint. And developer added some logic to bypass the authentication: if server recieve HTTP header give_me_access=...
Ярига Олег's user avatar
0 votes
1 answer
1k views

Is frame busting javascript required despite x-frame-options

I am using x-frame-options sameorigin header to prevent some of my websites from being loaded in iframes. Is this a foolproof method to prevent iframe loading? There have been several old threads on ...
Kannan's user avatar
  • 107
1 vote
1 answer
229 views

Multiple server fields in HTTP Response

Recently, during a pen-testing exercise, I noticed that the target server responded with multiple "Server" fields in the header. I was wondering what it could mean and if oddity is somehow ...
7_R3X's user avatar
  • 656
0 votes
1 answer
310 views

Does an url that redirecting infinitely have any impact to website?

I am testing a bug bounty website, and found an endpoint like www.example.com/infinite. When open it, it keep doing 302 redirect to itself until browser stops it for redirecting too many times. For ...
trieulieuf9's user avatar
2 votes
3 answers
774 views

Is there any way for a client to view headers set by an NGINX reverse proxy?

I am setting up an NGINX reverse proxy, which sits in front of an API. I would like to use: proxy_set_header X-Secret-Key ${SECRET_VALUE}; to add a token to the request, which is then read by the API. ...
Lachy's user avatar
  • 121
1 vote
0 answers
302 views

HTTP: Headers vulnerability still showing after being added

A web vulnerability assessment was done on our web app by a third company that specializes in security, and we added common headers that we missing, and to check my headers internally before the third ...
Billy Watsy's user avatar
1 vote
1 answer
188 views

Can the Origin header have alphabetical port or parameters in a real-life scenario?

I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid. Origin: ...
Jack's user avatar
  • 11
1 vote
1 answer
557 views

HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy

I'm checking the options to harden my web app by setting the appropriate HTTP headers. Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
Mike's user avatar
  • 113
2 votes
1 answer
369 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
DannyNiu's user avatar
  • 374
2 votes
1 answer
236 views

Content-Secure-Policy headers

I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
felipe guerraruiz's user avatar
0 votes
2 answers
293 views

Can we read HTTP cookie value? [closed]

In one of the applications I'm testing, the cookie contains the username (set:cookie: username) in the HTTP header. Is it possible to read these cookie values using any methods? The site uses HTTPS.
Shiva Kumar Itha's user avatar
0 votes
1 answer
4k views

Is the IP address of the client present in the email headers for webmail services and for desktop clients?

When I receive an email sent by someone using a webmail service (e.g. Gmail, etc.), I can find the IP address of the sender's email server in the email headers. But do the email headers also contain ...
Basj's user avatar
  • 953
2 votes
0 answers
1k views

Do object-src and base-uri bypasses still work on Content-Security-Policies?

I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header: Content-...
Maikkeyy's user avatar
  • 217
1 vote
3 answers
191 views

Should all the headers reported by securityheaders.io be considered as findings?

A lot of websites scanned with securityheaders.io are missing different headers. Should all of these headers be reported as findings or just few of them which are more critical?
Maicake's user avatar
  • 567
0 votes
2 answers
918 views

HTTP Request Smuggling Basics

I am currently trying to learn HTTP Request Smuggling vulnerability to further enhance my pen testing skills. I have watched a couple of videos on Youtube and read articles online regarding it but ...
Emanuel Beni's user avatar
1 vote
2 answers
3k views

IP address leaked in email header?

Can my IP address ever be included in the header of emails I send? Or do email servers never include my IP address in my emails' headers?
Geremia's user avatar
  • 1,763
1 vote
2 answers
7k views

Authorization Header in dev tools

My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call. This will expose the ...
Kumar's user avatar
  • 285
1 vote
1 answer
1k views

Enabling HTTP Security headers in S/4 Hana web applications

We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn't figure out how to go about it. We then approached SAP directly and even their solutions are ...
Ashish Gupta's user avatar