Preventing HTTP response splitting

HTTP response splitting or CRLF injection is another injection vulnerability where the attacker can send an unfiltered HTTP request that includes a carriage return and line feed characters. Allowing a carriage return (%0d, in URL encoded form) and line feed (%0a, also in URL encoded form) in the request introduces a split in the HTTP response headers, thus changing the behavior of the ASP.NET Core web application. This HTTP response header modification can lead to the exploitation of many other vulnerabilities, such as open redirection or cross-site scripting, to name a couple.

In this recipe, we will prevent HTTP response splitting in our code by adding a validation check to the \n and \r characters.

Getting ready

Run the sample app to verify that there are no build or compile errors. In your command shell, navigate to the sample app folder at \Chapter12\crlf-injection\before\OnlineBankingApp and run the following command:

dotnet build...