---
title: "Strip line breaks from headers and logs · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/input-and-injection/header-injection
id: APS-6
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 696
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Strip line breaks from headers and logs

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Input and injection](https://agentwranglers.se/playbook/application-security/input-and-injection.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-6
- Level: Recommended
- Chapter: [Input and injection](https://agentwranglers.se/playbook/application-security/input-and-injection.md)
- Rule: Remove or reject line breaks in any input that goes into a header, a redirect, an email header or a log line.
- Check: Send `PENTEST%0d%0aSet-Cookie:%20pt=1` in a redirect parameter and a contact form. No new header appears, and the log shows one line.
- How: Most web frameworks refuse line breaks in headers, so keep yours up to date. Encode values in log lines, or log as JSON so each entry stays on one line. Check email addresses against a strict pattern before they reach the mail headers.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
// Log as JSON: a line break in input stays inside one entry
log.info(JSON.stringify({ event: 'login_failed', user: input }));
```

### Python example

```python
# Python: one JSON object per line keeps a line break inside the value
logger.info(json.dumps({"event": "login_failed", "user": user_input}))
```

## Sources

- [OWASP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)

## Related rules

- EML-1 [Send the headers every message needs](https://agentwranglers.se/playbook/email/message-basics/required-headers.md) in Email
- EML-56 [Never let visitors pick who gets your mail](https://agentwranglers.se/playbook/email/email-security/fixed-recipients.md) in Email

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/input-and-injection/header-injection">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep input out of templates](https://agentwranglers.se/playbook/application-security/input-and-injection/template-injection.md)
- Next: [Turn off external entities in XML](https://agentwranglers.se/playbook/application-security/input-and-injection/xml-entities.md)
- [Input and injection](https://agentwranglers.se/playbook/application-security/input-and-injection.md)