Category Archives: HTML

C#, HTML, Security

Improper Neutralization of CRLF Sequences in HTTP Headers

Leave a comment

Description

A function call contains an HTTP response splitting flaw. Writing untrusted input into an HTTP header allows an attacker to manipulate the HTTP response rendered by the browser, leading to cache poisoning and cross-site scripting attacks.

Recommendations

Remove unexpected carriage returns and line feeds from untrusted data used to construct an HTTP response. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.

A simple string extension can resolve this issue:

public static string CRLFRemoval(this string token)

{

    return token.Replace("%0d", string.Empty, StringComparison.InvariantCultureIgnoreCase)

                .Replace("%0D", string.Empty, StringComparison.InvariantCultureIgnoreCase)

                .Replace("\r", string.Empty)

                .Replace("\n", string.Empty)

                .Replace("%0a", string.Empty, StringComparison.InvariantCultureIgnoreCase)

                .Replace("%0A", string.Empty, StringComparison.InvariantCultureIgnoreCase);

}

Links for reference:

https://en.wikipedia.org/wiki/HTTP_response_splitting

https://securiteam.com/securityreviews/5WP0E2KFGK

https://www.owasp.org/index.php?title=Testing_for_HTTP_Splitting/Smuggling_(OTG-INPVAL-017)

HTML

No Caching in any Browser

Leave a comment

I need to stop caching across all browsers of my website for security reasons.  This has been driving me nuts over the past two weeks, as every method I try just keep allow some caching to be stored.  Easiest way to check is by pressing the back key on the browsers window as the results should update.

I finally found a solution

using HTML:

<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
<meta http-equiv="Pragma" content="no-cache" />
<meta http-equiv="Expires" content="0" />

In ASP.NET

Response.AppendHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
Response.AppendHeader("Pragma", "no-cache");
Response.AppendHeader("Expires", "0");

The Cache-Control is per the HTTP 1.1 spec for clients (and implicitly required by some browsers next to Expires), the Pragma is per the HTTP 1.0 spec for clients and proxies and Expires is per the HTTP 1.1 spec for clients and proxies. Other Cache-Control parameters are irrelevant if the above mentioned three are specified. The Last-Modified header as included in most other answers here is only if you actually want to cache the request, so you don’t need to specify it at all.

Note that when the page is served over HTTP and a header is present in both the HTTP response headers and the HTML meta tags, then the one specified in the response header will get precedence over the HTML meta tag. The HTML meta tag will only be used when the page is viewed from local disk file system. See also W3 HTML spec chapter 5.2.2. Take care with this when you don’t specify them programmatically, because the web server can namely include some default values. To verify the one and other, you can see/debug them using Firebug Net panel.