[Web-SIG] Newline values in WSGI response header values.

[Alan Kennedy]

[Graham]
> Thus, is an embedded newline in value invalid? Would it be reasonable
> for a WSGI adapter to flag it as an error?

>From a security POV, it may be advisable for WSGI servers to *not*
allow newlines in HTTP response headers; newlines in response headers
may be the result of an application's failure to sanitise its inputs.

http://en.wikipedia.org/wiki/HTTP_response_splitting

Regards,

Alan.