What you're asking for is illegal according to the HTTP 1.1 specification. Please note that the characters [ and < and > are all reserved characters within the HTTP 1.1 spec. They can only be included in an HTTP header value if they are appropriately escaped with quotes, which is also lacking in the provided input.

The proper place for HTML/XML content is NOT in an HTTP header. Re-architect your communication protocol to conform to web standards! Seriously, as an attacker, I live for finding nonstandard implementations like this, because they're nearly always proprietary and innately exploitable. Keep HTML/XML content in the request body where they belong.

@kwwall -- recommend closing.

@xeno6696 is correct, what bhuvanes...@gmail.com is asking for is forbidden by the spec, so we definitely should NOT allow it or otherwise try to support it. An attacker of course can pass whatever "evil" characters that they wish in HTTP request headers, but that doesn't mean that OWASP should do something to encourage developers to accept that.

Am I closing this. #willnotfix