X-Forwarded-Host / Forwarded header spoofing enables URL rewrite hijack #409

Summary

RequestInfo trusts Forwarded, X-Forwarded-Host, and X-Forwarded-Proto headers without validation against trusted proxies. An attacker setting X-Forwarded-Host: evil.com causes the HTML rewriter to replace all origin URLs with evil.com.

Refs

• crates/common/src/http_util.rs lines 55-75 — extract_request_host trusts forwarded headers

Recommendation

Strip or validate forwarded headers at the Fastly VCL layer, or validate against a configured allowlist.

Context

Production readiness audit — see #396