---
id: 2318
title: "All your header are belong to us"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/all-your-header-are-belong-to-us"
published_at: "2007-07-13T07:52:00Z"
tags: ["php", "web-security", "xss", "portswigger", "flash", "http-headers", "request-spoofing"]
phying_url: "https://phying.com/item/2318"
lang: en
---

# All your header are belong to us

## Summary

Alex's research shows Flash can spoof HTTP headers using underscore names like User_Agent, which PHP, Perl, Ruby and ColdFusion treat as genuine. Lesson: assume any request header is spoofable.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2007-07-13T07:52:00Z
- **Original:** https://portswigger.net/blog/all-your-header-are-belong-to-us
- **Phying News:** https://phying.com/item/2318