Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In ASP.NET, there is a setting EnableHeaderChecking that ensures no CRLF (newlines) are output in response headers. This prevents possible "response splitting" attacks.

Is there any equivalent configuration for classic ASP pages - specifically in IIS 5.1?

I have a large web application in classic ASP, where it appears some Response.Redirect calls are not filtering user input. So they are vulnerable to response splitting attacks.

The solution is to update all these pages so they filtering user input. Is there any setting at the server level to prevent (or encode) newlines in response headers?

share|improve this question

IIS 5.1 doesn't have an easy way to change the response headers. If you're up for writing an ISAPI extension you can do it, but you would likely have an easier time upgrading to Win7/2008 (IIS7) and using HTTP Modules instead.

If upgrading to IIS7 isn't an option, it's probably easiest to write a helper method in code like CleanResponseRedirect(url) that can do the cleaning for you before the Response.Redirect. Then replace all of your response.redirects with CleanResponseRedirect().

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.