7
votes
1answer
960 views

ASP.NET HTTP Response Splitting Attack

By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect: ...
7
votes
1answer
512 views

Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?

I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages. ...