https://coreyfarley.com/tags/host-header/ Recent content in Host Header on Corey Farley Hugo en-us Fri, 02 Oct 2026 00:00:00 +0000 https://coreyfarley.com/posts/host-header-ssrf/ Fri, 02 Oct 2026 00:00:00 +0000 https://coreyfarley.com/posts/host-header-ssrf/ This post talks about how the Host header becomes an SSRF primitive, how front-end routing works, why trusting the Host header breaks the trust boundary between proxy and back-end, and a full walkthrough of pivoting into an internal admin panel to delete a user. I also include a short briefing of the other Host header attack paths and the bypass tricks worth having on hand when the header is validated.