HTTP Cache Poisoning via Host Header Injection

This is definitely a real issue, I was able to demonstrate cache poisoning in my Rails app because a plugin does this. I fixed it by only caching pages with explicitly valid Host headers, and by re-writing the Host header in nginx if it looks invalid.

Interesting. At I first I thought that the poisened url would only affect my own session and would be pretty useless with https, but combined with caching, it is definitely a very interesting approach.

I think this is legit. But it only really affects servers or infrastructure that employ caching.

The fix is simple - validate the contents of the Host field at the start of a request

"<a href="http://evilsite.com#/about">About</a>"

There is absolutely no reason to build links with your own hostname in them in the first place. Why on earth would you make a link like this instead of href="/about"?

edited to add: the spec says that the Location header for a redirect must be an absolute URI, so that's one case where you'd need to know your hostname. But you certainly don't need it to build links.