On Thu, Jul 9, 2026, at 18:07, Jorg Sowa wrote:
> While [rejecting newlines in cURL headers] would be a useful improvement, it 
> introduces BC concerns. I would prefer to see this change go through a 
> deprecation phase first, so we can avoid unexpectedly breaking existing user 
> implementations.

Thank you for your feedback. It seems to me that this is exactly a case where 
this policy applies: 
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy

I asked Daniel Stenberg about whether newlines are allowed in headers, and he 
said:

> The documentation says in clear terms:
> 
>    The headers included in the linked list must not be CRLF-terminated
> 
> I believe libcurl might change its treatment of them in a future and start 
> returning error earlier when such octets are found.

Regards,

Sjoerd

Reply via email to