The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Preventing Header Injection Vulnerabilities

The most effective way to prevent HTTP header injection vulnerabilities is to

not insert user-controllable input into the HTTP headers returned by the appli-

cation. As you saw with arbitrary redirection vulnerabilities, there are usually

safer alternatives available to this behavior.

If it is considered unavoidable to insert user-controllable data into HTTP

headers, the application should employ a twofold defense-in-depth approach

to prevent any vulnerabilities arising:

■■