Re: Should libcurl validate HTTP headers?

On Sun, 12 Apr 2026, Demi Marie Obenour via curl-library wrote:

> I'm wondering if libcurl should validate the HTTP headers provided to it. 
> I know that it currently doesn't, but passing a bad header is almost 
> certainly an app bug.

Maybe it should. There has been no demand for this from actual uses over the 
years but it is one of the most commonly reported claimed "security 
vulnerabilities" that we reject.

Additionally: there are also other options that accept almost anything the 
user passes in that can end up in outgoing protocol exchanges.

-- 

  / daniel.haxx.se || https://rock-solid.curl.dev
-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library
Etiquette:   https://curl.se/mail/etiquette.html