Hacksplaining
  • For Teams
Log in Start Learning

Host Header Poisoning

However, in some scenarios the web-server does need to know what domain it is running on. For instance, when a web application generates transactional emails, any links in those emails will be opened from an external source (the email client), so they need to be absolute URLs - containing the domain.

A Hyperlink in an Email
<!-- Links in emails DO need the domain specified. -->
<a href="https://www.website.com/reset/318ae962fe1">
  Click here reset your password
</a>
Hacksplaining

Defend your code.

Learn

All Lessons AI Prompt Injection SQL Injection XSS CSRF

Teams

For Teams Features Pricing FAQ

Resources

Glossary OWASP Top 10 PCI Compliance Book

Legal

Privacy Terms DPA Subprocessors

© 2026 Hacksplaining. Built with in Seattle, WA, USA

Need help? Reach out to support@hacksplaining.com