Establishing security against Host Header Injection Attack

Host header injection attack can occur if an attacker sends a crafted HTTP request that alters the Host header, which the server relies on to identify the request's origin. If the server implicitly trusts this value without performing proper validation, an attacker could inject a malicious domain or manipulate routing. This could result in unauthorized re-directions, tampered responses, or compromise critical functions.

To protect against Host Header Injection Attacks and ensure only legitimate values are accepted, configure the server configuration trustedHostnames in the eqaprof.env file. Identify the hostnames or IP addresses from which you want to trust requests, and explicitly add them as an entry. For example: trustedHostnames=localhost:8143.