Hi Tim,
Il 09/07/2026 13:10, Tim Düsterhus ha scritto:
Hi
On 2026-07-09 12:49, Matteo Beccati wrote:
"\r\n" inside headers used to be perfectly legal for multiline headers.
This is not correct. What was legal was the sequence "\r\n" followed *by
either a space or a tab*. And it is equivalent to just a space. The
newlines are not “visible” in the parsed value. There is literally zero
reason to emit the obsolete line-folding syntax nowadays. As far as I
can tell it only existed due to considerations regarding the length of a
single line.
Yes, that's precisely my point. "\r\n" followed by a space or tab used
to be a thing. Yes, it is obsolete, but for whatever reason I might be
required to test that specific scenario using curl.
Curl specifically documents:
The headers included in the linked list must not be CRLF-terminated,
since libcurl adds CRLF after each header item itself. Failure to
comply with this might result in strange behavior. libcurl passes on
the verbatim strings you give it, without any filter or other safe
guards. That includes white space and control characters.
Yes, and that seems to be a design choice from the curl team, that we
might want to respect.
Blocking "\r\n" would be perfectly fine in a userland HTTP Client before
calling curl_setopt().
Cheers
--
Matteo Beccati
