Document Scope and Audience

Avoiding Redirection Attacks

When a request on a Web application is redirected to another location, the Host header contained in the request is used by default in the Location header that is generated for the response. Because the Host header can be spoofed—that is, corrupted to contain a different host name and other parameters—this behavior can be exploited to launch a redirection attack on a third party.

To prevent the likelihood of this occurrence, set the FrontendHost attribute on either the WebServerMBean or ClusterMBean to specify the host to which all redirected URLs are sent. The host specified in the FrontendHost attribute will be used in the Location header of the response instead of the one contained in the original request. For more information, see FrontendHost in Oracle WebLogic Server MBean Reference.