6 Replies Latest reply on Dec 7, 2017 4:31 PM by Stuart Douglas

    Ignoring the Host Header Value and Use configured host name in responses.

    Alex Anon Newbie

      I don't administer the Jboss/Wildfly deployment, but am looking to help the team out in fixing the issue. As of yet we have been coming up empty. Here is a simplistic sanitized example of the issue.

       

      Curl  -v https://localhost:8443/webapp -H “Host: evil.com”

       

      Returns

       

      GET /webapp HTTP/1.1

      Host: evil.com

      User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0

      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

      Accept-Language: en-US,en;q=0.5

      Cookie: JSESSIONID=RandomString; user=userName; locale=en-US

      Connection: close

      Upgrade-Insecure-Requests: 1

       

      HTTP/1.1 302 Moved Temporarily

      Server: Apache-Coyote/1.1

      Location: https://evil.com/webapp/

      Date: Thu, 19 Oct 2017 22:01:37 GMT

      Connection: close

       

      Basically we are looking for a way to make the location during redirects remain https://localhost:8443/<uri>