Re: [PHP-DEV] Disallow newlines in CURLOPT_HTTPHEADER

On Thu, Jul 9, 2026, at 18:07, Jorg Sowa wrote:
> While [rejecting newlines in cURL headers] would be a useful improvement, it introduces BC concerns. I would prefer to see this change go through a deprecation phase first, so we can avoid unexpectedly breaking existing user implementations.

Thank you for your feedback. It seems to me that this is exactly a case where this policy applies: https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy

I asked Daniel Stenberg about whether newlines are allowed in headers, and he said:

> The documentation says in clear terms:
> 
>    The headers included in the linked list must not be CRLF-terminated
> 
> I believe libcurl might change its treatment of them in a future and start 
> returning error earlier when such octets are found.

Regards,

Sjoerd