Q44: What is HTTP Response Splitting and how does Node.js defend against it?
HTTP Response Splitting occurs when untrusted user input containing carriage return (\r) and line feed (\n) characters is injected into HTTP response headers, allowing attackers to inject arbitrary headers or split responses. Node.js mitigates this by automatically throwing an error (ERR_INVALID_HTTP_TOKEN) if header keys or values contain CRLF characters.
Key Takeaways
- CRLF injection allows attackers to inject malicious headers or manipulate HTTP body content.
- Node.js enforces strict internal header character validations to block CRLF injection attempts.
Knowledge Check
Which character combination is used in HTTP Response Splitting attacks to inject unauthorized headers?