Skip to content

Whitespace is not stripped from the right side of header values, as the RFCs require #47

Closed

Description

@kenballus

Description

The HTTP RFC ABNF states that spaces and tabs on either side of header values are not to be considered part of the header value.

When protocol-http1 receives a request with spaces or tabs on the right side of a header value, it does not strip that whitespace.

This is in contrast to the behavior of nearly all other popular HTTP implementations.

Reproduction Steps

  1. Run a protocol-http1 web server that echoes back received header values, like this one.
  2. Send it a request with a header containing whitespace, and observe the response:
printf 'GET / HTTP/1.1\r\nHost: a \r\n\r\n' \
    | timeout 1 ncat localhost 80 \
    | grep '"headers"' \
    | jq .headers[0][1] \
    | xargs echo \
    | base64 -d \
    | od -tcx1
0000000   a
         61  20
0000002

The trailing space (0x20) persists in the parsed header value.

Activity

  1. ioquatix commented on Sep 5, 2025

    @ioquatix
    Member

    Do you want to propose a fix?

  2. kenballus commented on Sep 8, 2025

    @kenballus
    Author

    Do you want to propose a fix?

    I sure do :)
    Just submitted a PR.

  3. added a commit that references this issue on Mar 10, 2026
    e0fda0f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions