A production change replaced two Nginx reverse‑proxy servers, introduced an upstream name containing an underscore, broke the Host header required by HTTP/1.1, and caused Spring Cloud Gateway to return 400 Bad Request for every request until the configuration was corrected.
A production incident caused by replacing two Nginx reverse proxies introduced an upstream name with an underscore, resulting in invalid Host headers and 400 Bad Request responses from Spring Cloud Gateway; the article details the step‑by‑step investigation, evidence from logs, tcpdump, and code, and presents configuration fixes to restore normal operation.
This article explains why the HTTP Host header is unsafe, demonstrates how attackers can hijack password‑reset links or launch SSRF by forging it, and provides three practical Nginx configuration methods to strictly validate Host values and block malicious requests.
This article demonstrates how a NextJS SSRF vulnerability (CVE‑2024‑34351) can be exploited by abusing the HTTP Host header, walks through the underlying code, reproduces the attack to retrieve a protected flag file, and discusses mitigation strategies for developers.
Although you can obtain a website’s IP address, accessing it directly via HTTPS often fails because the HTTP request’s Host header differs, and servers use this header to verify the intended domain, leading to 403 errors unless the correct Host value is supplied.
The article explains why visiting a website by its IP address often results in errors, showing that the HTTP Host header differs from domain‑based requests, and demonstrates this with Fiddler and Postman experiments using Baidu as an example.
This article explains why accessing a site via its IP address fails, revealing that the HTTP Host header distinguishes domain‑based requests from raw IP requests, and shows how adjusting the Host field restores access.
This article explains how misconfigured HTTP Host headers can be abused for attacks such as cache poisoning, SSRF, password‑reset poisoning and other server‑side exploits, and provides practical detection methods and defensive recommendations for developers and security engineers.
This article walks through a real‑world Nginx 400 Bad Request incident, explaining how missing or malformed Host headers and added proxy headers caused the error, and provides step‑by‑step diagnostics, configuration comparisons, and the final fix of using the correct $host variable.
