c/selfhosted@lemmy.world · sanitation@lemmy.today · 27 Aug 2026 12:49

Hardening Traefik Against Header Alias Spoofing with underscoreHeadersStrategy and aliasHeadersStrategy

LRVT's Security Blog Hardening Traefik Against Header Alias Spoofing with underscoreHeadersStrategy and aliasHeadersStrategy Learn how Traefik’s underscoreHeadersStrategy and aliasHeadersStrategy harden reverse-proxy deployments by blocking underscore header aliases that can enable spoofing attacks, including attack chains related to CVE-2024-45410 and CVE-2026-33433.

check post at origin

Traefik v3.7.12 deprecates the previously introduced underscoreHeadersStrategy entrypoint option and introduces a new one called aliasHeadersStrategy that rejects even more potentially spoofed headers - not just with underscores.

Reminder to adjust your Traefik config.

Add an entry point option to handle request headers with aliasing names by rtribotte · Pull Request #13720 · traefik/traefik

Hardening Traefik Against Header Alias Spoofing with underscoreHeadersStrategy and aliasHeadersStrategy

comments