I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace to space (%20). I wanna to confirm whether I am right or I doing the wrong way. Any comment and and suggestion are welcome.

For your information

  • Server info: GlassFish Server Open Source Edition 4.0
  • Servlet version: 3.0
  • JSP version: 2.1
  • Java version: 1.7.0_51

1 Answer 1


Yes, GlassFish does filter newline characters in headers. Tomcat does as well. I don't know about other servlet containers (Jetty, WebSphere, etc.)

com.sun.net.httpserver does NOT filter newlines, so you can use that for your simulation.

  • I new to JSP. Do you mind to provide the sample code that I should replace sendRedirect() to simulate the CLRF attack? I can't find the method redirect in com.sun.net.httpserver or I miss understand something? Thank you.
    – overshadow
    Sep 9, 2014 at 9:59
  • Did you get a basic web server working? Roughly speaking, you need to do httpExchange.getResponseHeaders().add("Location", "Blah\nBlah")
    – paj28
    Sep 9, 2014 at 10:06
  • Yup, my Web server is working. Do I need to change the server? Cause I am still using the GlassFish. I roughly got what you mean from the code. I will try it. Thank you.
    – overshadow
    Sep 9, 2014 at 10:15
  • @overshadow - java2s.com/Tutorial/Java/0320__Network/…
    – paj28
    Sep 9, 2014 at 10:20
  • I see, you mean create a server to handle the http request. Haha. Thank you very much. Your help is very much appreciated.
    – overshadow
    Sep 9, 2014 at 10:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .