My J2EE application is vulnerable to HTTP header injection attack. I want to make it secure from this vulnerability. Also, I am searching if any library (Maven dependency) available for this.
-
HTTP header injection occurs when user input is used to dynamically generate such headers. So it all boils down to input validation. – Jeroen Sep 18 at 10:34
I think that implementing a library for specifically 1 vulnerability like this, which has an easy fix, is overkill.
Is user input from the headers necessary? If not, then eliminate it.
If user input from the headers is necessary, can you whitelist this input?
If you cannot whitelist the input, can you sanitize the input by stripping newline (i.e. %0d%0a, \r\n) characters?
If you cannot strip newline characters, can you escape them?
If all above fails, you should look into a WAF solution.
