diff --git a/uw-spring-security-sample-war/src/main/java/edu/wisc/uwss/sample/configuration/DemonstrationOnlyPreAuthenticationConfiguration.java b/uw-spring-security-sample-war/src/main/java/edu/wisc/uwss/sample/configuration/DemonstrationOnlyPreAuthenticationConfiguration.java
index fa8c773a234369b39614eae65baf488c1904fbf7..0f5f269ff3bf5bf2f335a77ac584d0b1d4f2ad65 100644
--- a/uw-spring-security-sample-war/src/main/java/edu/wisc/uwss/sample/configuration/DemonstrationOnlyPreAuthenticationConfiguration.java
+++ b/uw-spring-security-sample-war/src/main/java/edu/wisc/uwss/sample/configuration/DemonstrationOnlyPreAuthenticationConfiguration.java
@@ -96,6 +96,10 @@ public class DemonstrationOnlyPreAuthenticationConfiguration {
           HttpServletRequest httpRequest = (HttpServletRequest) request;
           String uri = httpRequest.getRequestURI();
           String param = httpRequest.getParameter("_ignorepreauth");
+
+          // remove CRLF to avoid CWE-93
+          uri = (uri!=null) ? uri.replaceAll("([\\r\\n])", " ") : null;
+          param = (param!=null) ? param.replace("([\\r\\n])","") : null;
           logger.debug("uri={}, param={}", uri, param);
           if(null != param || IGNORED.contains(uri)) {
             logger.info("skipping PreAuthenticationSimulationServletFilter, either due to '_ignorepreauth' or visiting ignore uri");