# HTTP Response Splitting

> Detects HTTP response splitting via CRLF injection in response headers, enabling cache poisoning and XSS.

- Skill: `zakirkun/http-response-splitting` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/http-response-splitting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/http-response-splitting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/http-response-splitting

---


# HTTP Response Splitting

## Overview
HTTP Response Splitting is a more severe form of header injection. By injecting `\r\n` (CRLF) sequences into response headers, an attacker can:
- Inject arbitrary HTTP headers
- Add a second HTTP response body (response splitting)
- Poison shared caches (CDNs, proxies) with malicious content
- Execute XSS by injecting a fake HTML body

## Detection Strategy
Look for unvalidated user input placed in any HTTP response header, particularly `Location`, `Set-Cookie`, and `Content-Type`.

## Remediation
- Reject input containing `\r` or `\n` characters
- Use framework APIs that automatically sanitize header values
- Apply output encoding before placing user data in headers