Some HTTP headers might occurr only once in a HTTP message (e.g. Content-Length, Location, Host, Content-Disposition, etc.).
Messages which contain these headers multiple times should be rejected for security reasons.
Content-Length injection leads to response splitting
Location leads to redirect hijacking.
Some HTTP headers might occurr only once in a HTTP message (e.g. Content-Length, Location, Host, Content-Disposition, etc.).
Messages which contain these headers multiple times should be rejected for security reasons.
Content-Length injection leads to response splitting
Location leads to redirect hijacking.