# HTTP header injection

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/HTTP_header_injection
> Markdown URL: https://mediated.wiki/source/HTTP_header_injection.md
> Source: https://en.wikipedia.org/wiki/HTTP_header_injection
> Source revision: 1355026794
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

**HTTP header injection** is a general class of [web application](/source/Web_application) [security vulnerability](/source/Security_vulnerability) which occurs when [Hypertext Transfer Protocol](/source/Hypertext_Transfer_Protocol) ([HTTP](/source/HTTP)) [headers](/source/List_of_HTTP_headers) are dynamically generated based on user input. [Header](/source/Header_(computing)) injection in HTTP responses can allow for [HTTP response splitting](/source/HTTP_response_splitting), [session fixation](/source/Session_fixation) via the Set-[Cookie](/source/HTTP_cookie) header, [cross-site scripting](/source/Cross-site_scripting) (XSS), and malicious redirect attacks via the location header. [XSS](/source/XSS) attacks can be blocked with the use of a [browser extension](/source/Browser_extension) such as [NoScript](/source/NoScript) or Malwarebytes Browser Guard.

## Sources

- [File Download Injection](https://dl.packetstormsecurity.net/papers/attack/Aspect_File_Download_Injection.pdf)
- [OWASP HTTP request Splitting](https://www.owasp.org/index.php/HTTP_Response_Splitting)
- [OWASP Testing for HTTP Splitting/Smuggling](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/15-Testing_for_HTTP_Splitting_Smuggling)
- [HTTP Smuggling in 2015](https://regilero.github.io/security/english/2015/10/04/http_smuggling_in_2015_part_one/)
- [NoScript Official Website](https://noscript.net)

## See also

- [HTTP request smuggling](/source/HTTP_request_smuggling)

---
Adapted from the Wikipedia article [HTTP header injection](https://en.wikipedia.org/wiki/HTTP_header_injection) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/HTTP_header_injection?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.