KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
Is it sufficient to have [ System.Web.Configuration.HttpRuntimeSection.EnableHeaderChecking ]( http://msdn.microsoft.com/en-us/library/system.web.configuration.httpruntimesection.enableheaderchecking(VS.85).aspx) set to true (default) to fully prevent Http Header Injection attacks like Response Splitting etc.? I'm asking because a white box penetration testing tool (fortify) reports exploitable http header injection issues with HttpResponse.Redirect and cookies but I haven't found a way to successfully perform an attack. ( edit :..and we have EnableHeaderChecking turned on..)
Tags (comma-separated)
Save Edits
Cancel