HTTP header injection
Jump to navigation
Jump to search
This article has an unclear citation style. (March 2024) |
HTTP |
---|
Request methods |
Header fields |
Response status codes |
Security access control methods |
Security vulnerabilities |
HTTP header injection is a general class of web application security vulnerability which occurs when Hypertext Transfer Protocol (HTTP) headers are dynamically generated based on user input. Header injection in HTTP responses can allow for HTTP response splitting, session fixation via the Set-Cookie header, cross-site scripting (XSS), and malicious redirect attacks via the location header.
Sources
- File Download Injection
- OWASP HTTP request Splitting
- OWASP Testing for HTTP Splitting/Smuggling
- HTTP Smuggling in 2015
See also
References
Categories:
- Articles with short description
- Short description is different from Wikidata
- Wikipedia references cleanup from March 2024
- All articles needing references cleanup
- Articles covered by WikiProject Wikify from March 2024
- All articles covered by WikiProject Wikify
- Web security exploits
- Hypertext Transfer Protocol headers
- All stub articles
- World Wide Web stubs