Collected research

Abusing HTTP hop-by-hop request headers

Naming arbitrary headers in the HTTP Connection header marks them hop-by-hop, and proxies that forward that list instead of consuming it let an attacker delete headers a downstream hop added. Removing X-Forwarded-For can make an application treat the request as internal, and the trick also fingerprints caches, bypasses WAF rules that require a header, and can poison caches with error responses.

Record

Published by

nathandavison.com

Topic

HTTP

In the archive

• Collected in the 2019 research round

Related sources

• Author detection script

Tags

• cache-poisoning
• waf-bypass
• auth-bypass
• dos
• info-leak
• http
• proxy
• reverse-proxy
• cache
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of nathandavison.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.