header-injection

Prevent HTTP header injection by sanitizing CRLF characters from user input before assigning values to response headers. Stripping carriage return and line feed sequences stops attackers from injecting arbitrary headers or splitting HTTP responses in web servers and API backends.

HTTP response splitting occurs when CRLF injection allows attackers to insert carriage return and line feed characters into response headers. This breaks the HTTP response boundary, enabling the injection of malicious headers or body content through unsanitized user-derived header values.

Sanitize Content-Disposition and Location headers by enforcing safe encoding practices and stripping CRLF sequences from all input values. This prevents header injection when setting response headers dynamically from request parameters or external data sources.

Yes, sanitize forwarded and request-derived headers to prevent header-based data leakage. Removing CRLF sequences from these values before they are included in response headers mitigates both injection attacks and unintended exposure of sensitive header data.

Scan your codebase for all places that set response headers from user input, request parameters, or external data, then apply CRLF sanitization guidance to each location. Verify that every header-setting code path enforces safe value handling and proper encoding.