1

My J2EE application is vulnerable to HTTP header injection attack. I want to make it secure from this vulnerability. Also, I am searching if any library (Maven dependency) available for this.

Improve this question
1
  • HTTP header injection occurs when user input is used to dynamically generate such headers. So it all boils down to input validation.
    – Jeroen
    Sep 18, 2020 at 10:34

1 Answer 1

Reset to default
2

I think that implementing a library for specifically 1 vulnerability like this, which has an easy fix, is overkill.

Is user input from the headers necessary? If not, then eliminate it.

If user input from the headers is necessary, can you whitelist this input?

If you cannot whitelist the input, can you sanitize the input by stripping newline (i.e. %0d%0a, \r\n) characters?

If you cannot strip newline characters, can you escape them?

If all above fails, you should look into a WAF solution.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.