> "The attack is trivial to prevent; just don't allow newlines (and, ideally, active HTML characters) in redirect content." Surely the more correct solution is

> "The attack is trivial to prevent; just don't allow newlines (and, ideally, active HTML characters) in redirect content." Surely the more correct solution is to escape them properly. eg in the example: Location: javascript: <script>alert(document.cookie)</script> occurs because something unescaped the %0D%0A%0D%0A. If however you just leave it as it was originally, or alternatively encode it properly after you've decoded it. Location: javascript:%0D%0A%0D%0A<script>alert(document.cookie)</script> and everything works as it should.