Re: Disallow newlines in CURLOPT_HTTPHEADER
| From: | Sjoerd Langkemper | Date: | Mon, 13 Jul 2026 11:00:38 +0000 |
| Subject: | Re: Disallow newlines in CURLOPT_HTTPHEADER | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-131880@lists.php.net to get a copy of this message | ||
On Thu, Jul 9, 2026, at 18:07, Jorg Sowa wrote:
> While [rejecting newlines in cURL headers] would be a useful improvement, it introduces BC
> concerns. I would prefer to see this change go through a deprecation phase first, so we can avoid
> unexpectedly breaking existing user implementations.
Thank you for your feedback. It seems to me that this is exactly a case where this policy applies:
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy
I asked Daniel Stenberg about whether newlines are allowed in headers, and he said:
> The documentation says in clear terms:
>
> The headers included in the linked list must not be CRLF-terminated
>
> I believe libcurl might change its treatment of them in a future and start
> returning error earlier when such octets are found.
Regards,
Sjoerd