Unverified50% confidenceOpinionExact time
There are three reasons why HTTP response headers have become an ideal channel for prompt injection: invisible (not rendered on the page), not intercepted (security scanners/WAFs/content filters mostly target HTML body and scripts), and cross-site persistent (the same header field may appear in massive responses under a CDN, reverse proxy, or domain).
1
Sources
50%
Confidence
Long-term
Relevance
10/15/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn web requests, newline characters (%0A or literal \n) in URL paths or query parameters are legitimate encoded characters that the HTTP layer does not automatically filter.70% similarUnverifiedHTTP还定义了Accept-Language、Accept-Encoding、Accept-Charset等内容协商机制65% similarUnverifiedWagtail的richtext模板过滤器会处理内部链接解析，存储页面ID而非URL，渲染时转换为实际URL，使页面路径变化后内部链接不会失效65% similarUnverifiedCompared with web page body injection, HTTP header field injection is far smaller in magnitude but far higher in stealth, as body injection is easily blocked by HTML sanitization and content policies, whereas header fields often bypass these layers.65% similarUnverifiedThe generated HTML viewer can run offline because all dependencies (rendering libraries, stylesheets, and interaction scripts) are inlined into a single HTML file at build time; in testing, the diagrams continued to display normally after HTTP requests were intercepted.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1036876API
curl https://kongchang.com/api/v1/knowledge/claims/1036876MCP
get_claim(id=1036876)