Header Injection

Also Known As

TL;DR

Explanation

HTTP headers are separated by CRLF (\r\n). If an attacker injects a newline into a header value, they can inject additional headers or even a second HTTP response body — a technique called HTTP Response Splitting. This can be used to poison caches, hijack redirects, or inject HTML/JavaScript. Prevention: strip all \r and \n characters from any user-supplied value before including it in a header().

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Passing unsanitised user input to PHP's header() function, especially in Location or Set-Cookie headers.
• Trusting X-Forwarded-For or Referer headers and reflecting them into responses.
• Not stripping \r and \n from any value that ends up in an HTTP header.
• URL-decoding values before passing to header() without re-stripping control characters.

Code Examples

// User input injected into header — attacker can inject newlines
\$lang = \$_GET['lang'];
header("Content-Language: \$lang");
// ?lang=en%0d%0aSet-Cookie:admin=1  → injects extra header

// Allowlist approach
\$allowed = ['en', 'fr', 'de', 'es', 'ja'];
\$lang    = in_array(\$_GET['lang'] ?? 'en', \$allowed, true)
           ? \$_GET['lang'] : 'en';
header("Content-Language: \$lang");

// If dynamic values are unavoidable, strip CR/LF:
\$clean = str_replace(["\r", "\n"], '', \$value);
header("X-Custom: \$clean");

References

• ↗ https://owasp.org/www-community/attacks/HTTP_Response_Splitting
• ↗ https://cwe.mitre.org/data/definitions/113.html

Tags

Related Terms