In ASP.NET, there is a setting EnableHeaderChecking that ensures no CRLF (newlines) are output in response headers. This prevents possible "response splitting" attacks.
Is there any equivalent configuration for classic ASP pages - specifically in IIS 5.1?
I have a large web application in classic ASP, where it appears some Response.Redirect calls are not filtering user input. So they are vulnerable to response splitting attacks.
The solution is to update all these pages so they filtering user input. Is there any setting at the server level to prevent (or encode) newlines in response headers?