# Host Header injection/tampering

**URL:** <https://forum.airlock.com/t/host-header-injection-tampering/340>\
**Category:** Ask the community\
**Tags:** microgateway, release\
**Created:** [June 27, 2025, 9:56am UTC](https://forum.airlock.com/t/host-header-injection-tampering/340 "2025-06-27T09:56:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhe](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@mhe](https://forum.airlock.com/u/mhe)\
**Post date:** [June 27, 2025, 9:56am UTC](https://forum.airlock.com/t/host-header-injection-tampering/340/1 "2025-06-27T09:56:33Z")

</div>

Hi there!

Does the MGW block requests with two host headers? I’m wondering about attack vectors like these: [How to identify and exploit HTTP Host header vulnerabilities | Web Security Academy](https://portswigger.net/web-security/host-header/exploiting)

Thanks!

---

<div class="post-metadata">

**Author:** ![dieti](https://avatars.discourse-cdn.com/v4/letter/d/41988e/32.png) [@dieti](https://forum.airlock.com/u/dieti)\
**Post date:** [July 1, 2025, 1:44pm UTC](https://forum.airlock.com/t/host-header-injection-tampering/340/2 "2025-07-01T13:44:33Z")

</div>

Hi @mhe

Thank you for asking this question. The answer is not that simple and depends a bit on the setup.

- **Data plane mode “Sidecar”**  
There are currently no checks. If multiple Host headers are received, they are forwarded in a comma separated format to the upstream service. Maybe a workaround with a LUA script is possible.

- **Data plane mode “Sidecarless” (Gateway API)**  
Requests with multiple Host header are blocked if an hostname is configured in the ‘hostnames’ field of the ‘HTTPRoute’.

As you might know, Airlock Microgateway is based on Envoy. The mentioned behavior in “data plane mode ‘Sidecar’” is Envoy’s default behavior. The mentioned feature for “data plane mode ‘Sidecarless’” provides protection against such requests. Anyway, we look into a possible solutions to provide protection also for our clients using “data plane mode ‘Sidecar’”.

To sum up:  
Airlock Microgateway provides currently a solution for “data plane mode ‘Sidecarless’”, if correctly configured. We are looking into possible solutions to improve the protection in a newer release.

Cheers  
Stefan

---

<div class="post-metadata">

**Author:** ![mhe](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@mhe](https://forum.airlock.com/u/mhe)\
**Post date:** [April 9, 2026, 3:01pm UTC](https://forum.airlock.com/t/host-header-injection-tampering/340/3 "2026-04-09T15:01:48Z")

</div>

Allow me a follow-up:

The following request is allowed:

```auto
curl -v https://dashboard.ourdomain.ch/ -H "Host: dashboard.ourdomain.ch:mytest.gugus.ch"

```

Airlock Microgateway takes the host header and puts it as is (dashboard.ourdomain.ch:mytest.gugus.ch) in the X-Forwarded-Host header.

This creates errors in our backend application (not Exceptions, but errors that are logged to Sentry …).

Is there no RFC or sanity check on the host header?

Thanks!

---

<div class="post-metadata">

**Author:** ![mhe](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@mhe](https://forum.airlock.com/u/mhe)\
**Post date:** [April 12, 2026, 1:49pm UTC](https://forum.airlock.com/t/host-header-injection-tampering/340/4 "2026-04-12T13:49:10Z")

</div>

I tried with deny rules, but with no success.

```auto
        - ruleKey: INVALID_HOST_HEADER
          blockData:
            header:
              name:
                matcher:
                  exact: host
              value:
                matcher:
                  regex: ".*:[^0-9].*"
          threatHandlingMode: LogOnly
        - ruleKey: CUSTOM_TESTHEADER
          blockData:
            header:
              name:
                matcher:
                  exact: testheader
              value:
                matcher:
                  regex: ".*:[^0-9].*"
          threatHandlingMode: LogOnly

```

For the ‘testheader’, I have log entries when I send requests with a testheader header like “dashboard.ourdomain.ch:mytest.gugus.ch“. When I send a host header like “dashboard.ourdomain.ch:mytest.gugus.ch“, I have no log entries.