# HTTP Header Injection / CRLF Injection

> Detects user-controlled data written into HTTP response headers without CRLF stripping, enabling header injection and response splitting.

- Skill: `zakirkun/http-header-injection-crlf-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/http-header-injection-crlf-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/http-header-injection-crlf-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/http-header-injection-crlf-injection

---


# HTTP Header Injection / CRLF Injection

## Overview
HTTP response header injection occurs when user-controlled data is placed in HTTP response headers without stripping carriage return (`\r`, `%0d`) and newline (`\n`, `%0a`) characters. This enables:
- **Response splitting**: Injecting a fake second HTTP response
- **XSS via header**: Injecting `Set-Cookie` headers with malicious cookies
- **Cache poisoning**: Poisoning shared proxies and CDN caches
- **Open redirect**: Via `Location` header manipulation

## Detection Strategy
Look for response headers that include user input from request parameters or paths.

## Remediation
- Validate and sanitize all user input before placing in headers
- Strip CRLF characters (`\r\n`) from any value placed in a header
- Use framework's built-in header sanitization

**Vulnerable (Python):**
```python
redirect_url = request.args.get('url')
response = make_response('', 302)
response.headers['Location'] = redirect_url  # CRLF injection!
```

**Safe (Python):**
```python
import re
redirect_url = re.sub(r'[\r\n]', '', request.args.get('url', ''))
```