Simon Willison’s Weblog

Response Splitting Risk. Important reminder that you should always ensure strings used in HTTP headers don’t contain newlines.

Posted 19th October 2008 at 11:58 pm

Recent articles

The evolution of OpenAI's mission statement - 13th February 2026
Introducing Showboat and Rodney, so agents can demo what they’ve built - 10th February 2026
How StrongDM's AI team build serious software without even looking at the code - 7th February 2026

http 100 rails 74 responsesplitting 1 security 575

Monthly briefing

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.

Pay me to send you less!

Sponsor & subscribe