System configuration · Question 11 of 12
An attacker sends a password request with the header "Host: evil.example". What prevents the link in the mail from pointing to their domain?
1 answer is correct. Hard
Show answer
Answer
- B trustedHostsPattern rejects the host
Explanation
TYPO3 builds absolute URLs, for example for password links, from the host header. If it does not match trustedHostsPattern, the middleware VerifyHostHeader aborts the request.