# Northwind Accounts — Host Header Injection (lab)

> Northwind's POST /reset-password builds the emailed reset link from the incoming Host / X-Forwarded-Host header, verbatim.

Canonical: https://codelivly.com/labs/host-header-injection

| | |
|---|---|
| Type | Web |
| Difficulty | Intermediate |
| Points | 250 |
| Session length | 30 min |
| Completions | 0 |

Northwind's POST /reset-password builds the emailed reset link from the incoming Host / X-Forwarded-Host header, verbatim. Read the handler, fix it to use a canonical hostname, and prove it with the built-in checker.

## Objective

Learn why the Host header (and X-Forwarded-Host) must never be trusted for security-relevant output. Both are ordinary request headers a client sets freely — not anything the server authenticated — so building a password-reset link from either lets a caller choose the domain that link points to. You will not be asked to build an attack flow; the lab shows you the poisoned link directly. Your job is to patch the handler to stop trusting it.

## Tasks

1. Open the lab and read the handler
2. See the risk, without crafting anything
3. Add a canonical hostname
4. Stop reading the request headers for this purpose
5. Run the checker

## Related

- [All labs](https://codelivly.com/practice?type=lab)