Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In ASP.NET, there is a setting EnableHeaderChecking that ensures no CRLF (newlines) are output in response headers. This prevents possible "response splitting" attacks.

Is there any equivalent configuration for classic ASP pages - specifically in IIS 5.1?

I have a large web application in classic ASP, where it appears some Response.Redirect calls are not filtering user input. So they are vulnerable to response splitting attacks.

The solution is to update all these pages so they filtering user input. Is there any setting at the server level to prevent (or encode) newlines in response headers?

share|improve this question
add comment

1 Answer

IIS 5.1 doesn't have an easy way to change the response headers. If you're up for writing an ISAPI extension you can do it, but you would likely have an easier time upgrading to Win7/2008 (IIS7) and using HTTP Modules instead.

If upgrading to IIS7 isn't an option, it's probably easiest to write a helper method in code like CleanResponseRedirect(url) that can do the cleaning for you before the Response.Redirect. Then replace all of your response.redirects with CleanResponseRedirect().

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.