Re: Disallow newlines in CURLOPT_HTTPHEADER
| From: | Matteo Beccati | Date: | Thu, 09 Jul 2026 11:01:34 +0000 |
| Subject: | Re: Disallow newlines in CURLOPT_HTTPHEADER | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-131834@lists.php.net to get a copy of this message | ||
Il 09/07/2026 12:49, Matteo Beccati ha scritto:
"\r\n" inside headers used to be perfectly legal for multiline headers. It is now obsolete, but I'm not sure why we should prevent it, if curl does not. See: https://www.rfc-editor.org/info/rfc9112/#name-obsolete-line-folding Apologies, I forgot the code example:curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-foo: foo\r\n bar"]); Tested on Apache + php 8.1: var_dump($_SERVER['HTTP_X_FOO']) happily returns: string(7) "foo bar" I haven't tested other configurations. Cheers -- Matteo Beccati