title: Tomcat Virtual Host to prevent Improper-Input-Handling attack
body: <p>I'm currently on the process of trying fix a site vulnerability, basically it is one type of the "Improper Input Handling" attack. </p>
  
  <p>Let's say my website is  <strong>www.mywebsite.com</strong> 
  and there is hacker's website <strong>www.hacker.com</strong> </p>
  
  <p>whenever there is a request send to <strong>www.mywebsite.com</strong> with modified "<code>Host</code>" header point to <strong>www.hacker.com</strong>, my site will create a redirect to <strong>www.mywebsite.com</strong> along with whatever the url it was. 
  e.g.</p>
  
  <p>Normal: </p>
  
  <pre><code>Host: www.mywebsite.com 
  GET  www.mywebsite.com/get/some/resources/
  Reponse 200 ok
  </code></pre>
  
  <p>Hack:</p>
  
  <pre><code>Host: www.hacker.com (#been manually modified) 
  GET  www.mywebsite.com/get/some/resources/
  Response 302 
  Send another Redirect to www.hacker.com/get/some/resources 
  </code></pre>
  
  <p>My website is running on Tomcat 7, I tried some solution with set up the virtual host by point the unknown host to a <code>defaultlocalhost</code> which suppose to do nothing. but it still send the redirect for some reason.</p>
  
  <p>Here attached is my <code>server.xml</code> host configure:</p>
  
  <pre><code>&lt;Engine name="Catalina" defaultHost="defaultlocalhost" jvmRoute="jvm1"&gt;  
  &lt;Host name="www.mywebsite.com"  appBase="webapps"
          unpackWARs="true" autoDeploy="false" deployOnStartup="true"&gt;
  
      &lt;Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
             prefix="localhost_access_log." suffix=".txt"
             pattern="%h %l %u %t &amp;quot;%r&amp;quot; %s %b" /&gt;
    &lt;/Host&gt;
  
    &lt;Host name="defaultlocalhost"  &gt;
  
    &lt;/Host&gt;
  </code></pre>
  
  <p><strong>So, my question is, Am I on the right track to prevent this kind of attack ? If yes, what I did wrong that still not working? (The ultimate goal is, if it is not the legit Host that been passed in, the request should be discard/ignored/return 404 but not redirect with 302</strong>) </p>
  
  <p>Thank you in advance. </p>
  
  <p>More references about the attack here :
  <a href="http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html" rel="noreferrer">http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html</a></p>
  
  <p><a href="http://projects.webappsec.org/w/page/13246933/Improper%20Input%20Handling" rel="noreferrer">http://projects.webappsec.org/w/page/13246933/Improper%20Input%20Handling</a></p>