header-injection

What problem does it solve?

Protects against HTTP response header injection where user input containing CRLF characters is included in response headers, allowing attackers to inject arbitrary headers or split the HTTP response.

Core Features & Use Cases

• Strips CRLF sequences from user-derived header values before they are set in responses.
• Sanitizes forwarded and request-derived headers to prevent header-based data leakage.
• Enforces safe encoding for Content-Disposition filenames and Location headers to prevent injection.
• Provides verification guidance to ensure all header-setting code paths are protected.

Quick Start

Scan your codebase for all places that set response headers from user input and apply the sanitization guidance.