title: Response Header validation in java
body: <p>I am passing directly a user defined parameter in my response header. Which I have learned is not a good idea since that way user can manipulate header and it can lead to Cross site scripting attacks and other kind of multiple attacks.</p>
  
  <p><a href="https://www.fortify.com/vulncat/en/vulncat/python/header_manipulation.html" rel="nofollow">https://www.fortify.com/vulncat/en/vulncat/python/header_manipulation.html</a></p>
  
  <p>What I am doing for preventing this is validate the user input for "http response splitting" by replacing "\r" and "\n" characters with empty string "". Is this enough or I have to check for other characters also. Any pointers would be of great help.</p>
  
  <p>This is my code.</p>
  
  <pre><code>if(response != null)
    {
     newResponse = response.replaceAll("[\r\n]", "");
    }
  </code></pre>
  
  <p>Is this enough for preventing this kind of attack or I should also validate for other characters.</p>