Is EnableHeaderChecking=true enough to prevent Http Header Injection attacks?

Asked 2009-05-15T15:30:18.750

Is it sufficient to have [System.Web.Configuration.HttpRuntimeSection.EnableHeaderChecking](http://msdn.microsoft.com/en-us/library/system.web.configuration.httpruntimesection.enableheaderchecking(VS.85).aspx) set to true (default) to fully prevent Http Header Injection attacks like Response Splitting etc.?

I'm asking because a white box penetration testing tool (fortify) reports exploitable http header injection issues with HttpResponse.Redirect and cookies but I haven't found a way to successfully perform an attack. (edit:..and we have EnableHeaderChecking turned on..)

Edit Report

2 Answers

EnableHeaderChecking is only for untrusted data. If you're passing data directly from a cookie into a Redirect, maybe the resulting headers are considered trusted and \r\n values aren't escaped.

answered 2009-05-19T09:38:00.800

Josef, HttpResponse.AppendHeader() is not the only place where untrusted data can enter the HTTP Response Headers.

Any data from the attacker that ends up in Cookies or HTTP redirects can write new headers if the data contains a carriage return (or anything that is interpreted as a carriage return).

In general, it's a much better use of your time to validate your data than to sit around and try to work out exploits. Chances are, the hackers are going to be better at this than you or I are.

answered 2010-07-22T23:06:55.027

Is EnableHeaderChecking=true enough to prevent Http Header Injection attacks?

2 Answers

Your Answer