grizzly
grizzly copied to clipboard
Enhances validation of HTTP header names
RFC 9110 specifies that only the following characters are allowed within header names:
field-name = token
token = 1*tchar
tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*"
/ "+" / "-" / "." / "^" / "_" / "`" / "|" / "~"
/ DIGIT / ALPHA
; any VCHAR, except delimiters
Grizzly HTTP does not enforce this rule.
1. I think Grizzly should follow this convention for header names.
Consider the following payload: GET / HTTP/1.1\r\nHost: a\r\nIgnore\r\nMy-Header: m\r\n\r\n
.
Grizzly's HTTP parser sees this payload as two requests, like so:
GET / HTTP/1.1\r\n
Host: a\r\n
Ignore\r\nMy-Header: m\r\n
\r\n
However, some HTTP parsers (e.g. Nginx, Libsoup, cpp-httplib) see only request, like so:
GET / HTTP/1.1\r\n
Host: a\r\n
Ignore\r\n
My-Header: m\r\n
\r\n
This happens because these parsers either ignore or permissively parse field-lines with no ':', so they see a My-Header header where Grizzly didn't.
2. I think it would be good for compatibility if, when parsing headers, it ignored incomplete field-lines like other parsers do.