Expected Findings
- `next` value is written to `Location` without sanitization.
- CRLF sequences create additional response headers.
- Same flaw affects redirect emails and 302 chains.
Header Reflection
CRLF Response Splitting
The redirect handler stuffs the `next` parameter into the `Location` header without stripping CRLF, allowing attackers to inject extra response headers.
CWE-93CWE-113
Splitting probe
Primary Flows
- CRLF redirect Injects Set-Cookie
- Header echo Reflects user value
Signals
Code
w.Header().Set("Location", req.URL.Query().Get("next"))