Reference articles on history, science, culture and more
Surprise meSurprise meSubscribe
Encyclopedia

HTTP header injection

Web application security vulnerability

Wikipedia contributorsAdapted for Fathomly · View authors
1 min read
Source updated May 19, 2026
Image credit is listed at the end of this article.

HTTP header injection is a general class of web application security vulnerability which occurs when Hypertext Transfer Protocol (HTTP) headers are dynamically generated based on user input. Header injection in HTTP responses can allow for HTTP response splitting, session fixation via the Set-Cookie header, cross-site scripting (XSS), and malicious redirect attacks via the location header. XSS attacks can be blocked with the use of a browser extension such as NoScript or Malwarebytes Browser Guard.

Watch videos about HTTP header injectionExplainers and documentaries on YouTube (opens in a new tab)

Sources and credits

This article is adapted from the Wikipedia article “HTTP header injection”, written by its contributors and licensed under CC BY-SA 4.0. Fathomly has changed the layout, removed citation markers, navigation and maintenance notices, and adjusted punctuation. This adapted version is shared under the same license. For references, see the original article.

Images, from Wikimedia Commons:

  • HTTP logo.svg by IETF HTTP Working Group (HTTPbis), Public domain

Fathomly is not affiliated with or endorsed by the Wikimedia Foundation. Spotted a problem? Tell us.

Continue exploring

Related topics

HTTP request smuggling

HTTP request smuggling is a security exploit on the HTTP protocol that takes advantage of an inconsistency between the interpretation of Content-Length and Transfer-Encoding headers between HTTP server implementations in a HTTP proxy server chain. HRS was first discovered in 2005 by Linhart et al.