---
title: "Strip line breaks from headers and logs · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/injection/header-injection
updated: 2026-10-20
licence: "All rights reserved"
---

# Strip line breaks from headers and logs

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Injection](https://agentwranglers.se/playbook/adversarial-testing/injection)
- Rule: Remove or reject line breaks in any input that goes into a header, a redirect, an email header or a log line.
- How: Most web frameworks refuse line breaks in headers, so keep yours up to date. Encode values in log lines, or log as JSON so each entry stays on one line. Check email addresses against a strict pattern before they reach the mail headers.
- Check: Send `AW-TEST%0d%0aSet-Cookie:%20aw=1` in a redirect parameter and a contact form. No new header appears, and the log shows one line.

Example:

```js
// Log as JSON: a line break in input stays inside one entry
log.info(JSON.stringify({ event: 'login_failed', user: input }));
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/injection/header-injection`.

- Previous: [Keep input out of templates](https://agentwranglers.se/playbook/adversarial-testing/injection/template-injection)
- Next: [Turn off external entities in XML](https://agentwranglers.se/playbook/adversarial-testing/injection/xml-entities)
- [Injection](https://agentwranglers.se/playbook/adversarial-testing/injection)