# How to mitigate the HTTPOxy vulnerability

HTTPoxy is a web application vulnerability caused by malicious HTTP requests. You can configure your application to mitigate HTTPOxy using [Rules Engine](/en/documentation/products/build/applications/rules-engine/).

---

## About HTTPoxy

HTTPoxy can affect web applications that use *Common Gateway Interface (CGI)* or CGI-like environments. CGI is the method responsible for handling user requests and establishing a line of communication between the client and the server through environment variables.

The `Proxy` header in HTTP requests was found to be vulnerable to malicious requests in CGI environments. When a `Proxy` value is sent to the server by a request header, that value overwrites the `HTTP_PROXY` environment variable used to configure outgoing proxies. This means that any internal request generated by the client can be redirected to an external proxy server, and all data contained within the request can be captured.

:::tip
For more information about this vulnerability, visit the official [HTTPoxy website](https://httpoxy.org/) or the [CERT Coordination Center (CERT/CC) vulnerability database](https://www.kb.cert.org/vuls/id/797896).
:::

---

## Creating a rule to block the HTTP Proxy header

In order to protect your applications against HTTPoxy, follow the steps below to block the `Proxy` header during the Request Phase.

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Applications**.
2. Select the application you want to configure against HTTPoxy attacks.
3. In the **Main Settings** tab, in the **Modules** section, enable **Application Accelerator**.
4. Click the **Save** button to save this setting.
5. Go to the **Rules Engine** tab and click the **+ Rule** button.
6. Add a name to your rule.
7. Select **Request Phase**.
8. In the **Criteria** section, add a criteria.
    - You can create a default rule to mitigate your application as a whole as follows: If `${uri}` starts with `/`
9. Then, in the **Behaviors** section, select the **Filter Request Header** behavior and add `proxy` as an argument.
10. Click the **Save** button.

Once the variable is set, if a malicious request is made to your application containing the `Proxy` header, your application will strip the header, protecting your origin from HTTPoxy attacks.