Enabling host header validation

Configure the com.ibm.elm.allowed_host_name flag to enable host header validation. This validation helps protect the application from host header injection, cache poisoning, and redirect-based attacks by allowing only trusted host names and ports in incoming HTTP requests.

Before you begin

You must have:

Access to modify JVM options, environment variables, or startup scripts.
The trusted host name (and optional port) to be validated.

Note: Host header validation is case-insensitive. Port validation is enforced only if specified in the com.ibm.elm.allowed_host_name flag. If the flag is not set, host header validation is skipped.

Procedure

Set the flag in one of the following ways:

Set as a JVM Option.
1. Open your jvm.options file or startup script.
2. Add the following flag:
```
-Dcom.ibm.elm.allowed_host_name=your.host.name.com
```
3. To include a port, add the following flag:
```
-Dcom.ibm.elm.allowed_host_name=your.host.name.com:9443
```
Set as an environment variable.
1. On Linux/macOS:
  1. Open a terminal.
  2. Run the following command:
```
export com.ibm.elm.allowed_host_name=your.host.name.com
```
2. On Windows:
  1. Open command prompt.
  2. Run the following command:
```
set com.ibm.elm.allowed_host_name=your.host.name.com
```

Modify server.startup.bat (Windows only).

Open the server.startup.bat file.

Add the following flag:

set JAVA_OPTS=%JAVA_OPTS% -Dcom.ibm.elm.allowed_host_name=your.host.name.com

To include a port, add the following flag:

set JAVA_OPTS=%JAVA_OPTS% -Dcom.ibm.elm.allowed_host_name=your.host.name.com:9443

Results

Host header validation is enabled. Incoming HTTP requests are accepted only if the host header matches the configured value.