I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace to space (%20). I wanna to confirm whether I am right or I doing the wrong way. Any comment and and suggestion are welcome.
For your information
- Server info: GlassFish Server Open Source Edition 4.0
- Servlet version: 3.0
- JSP version: 2.1
- Java version: 1.7.0_51