Re: [PHP-DEV] Disallow newlines in CURLOPT_HTTPHEADER

Il 09/07/2026 12:49, Matteo Beccati ha scritto:
> "\r\n" inside headers used to be perfectly legal for multiline headers.
> 
> It is now obsolete, but I'm not sure why we should prevent it, if curl 
> does not.
> 
> See:
> https://www.rfc-editor.org/info/rfc9112/#name-obsolete-line-folding
Apologies, I forgot the code example:

curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-foo: foo\r\n bar"]);

Tested on Apache + php 8.1:

var_dump($_SERVER['HTTP_X_FOO']) happily returns: string(7) "foo bar"


I haven't tested other configurations.


Cheers
-- 
Matteo Beccati