- Notifications
You must be signed in to change notification settings - Fork 373
Closed
Description
What is the issue with the Fetch Standard?
A header name has to match the field-name syntax (which is token) and does not allow all kind of values such as 0x00.
The specifications do not seem to specify however how to deal with invalid header names.
Should the whole response be discarded (network error)? Should only the invalid header (line) be discarded? Should the Null byte simply be ignored or treated as a space?
Example URL with 0x00: Example
- Chromium:
ERR_INVALID_HTTP_RESPONSE - Firefox and Safari: load, the invalid header seems to be ignored (it is not visible in devtools in Firefox, it is visible in Safari)
Related:
- For field-values the conclusion seems to be 0x00 is not allowed and should result in a network error: Why does headers-normalize-response.htm expect null bytes to be allowed? xhr#165
- Tests in WPT that test for 0x00 in header values but not in header names: XMLHttpRequest: response header value containing 0x00 web-platform-tests/wpt#10424
markcellus
Metadata
Metadata
Assignees
Labels
No labels