Re: [PHP-DEV] Disallow newlines in CURLOPT_HTTPHEADER

Hi Tim,

Il 09/07/2026 13:10, Tim Düsterhus ha scritto:
> Hi
> 
> On 2026-07-09 12:49, Matteo Beccati wrote:
>> "\r\n" inside headers used to be perfectly legal for multiline headers.
> 
> This is not correct. What was legal was the sequence "\r\n" followed *by 
> either a space or a tab*. And it is equivalent to just a space. The 
> newlines are not “visible” in the parsed value. There is literally zero 
> reason to emit the obsolete line-folding syntax nowadays. As far as I 
> can tell it only existed due to considerations regarding the length of a 
> single line.

Yes, that's precisely my point. "\r\n" followed by a space or tab used 
to be a thing. Yes, it is obsolete, but for whatever reason I might be 
required to test that specific scenario using curl.


> Curl specifically documents:
> 
>> The headers included in the linked list must not be CRLF-terminated, 
>> since libcurl adds CRLF after each header item itself. Failure to 
>> comply with this might result in strange behavior. libcurl passes on 
>> the verbatim strings you give it, without any filter or other safe 
>> guards. That includes white space and control characters.
Yes, and that seems to be a design choice from the curl team, that we 
might want to respect.

Blocking "\r\n" would be perfectly fine in a userland HTTP Client before 
calling curl_setopt().


Cheers
-- 
Matteo Beccati