Re: Disallow newlines in CURLOPT_HTTPHEADER
| From: | Sjoerd Langkemper | Date: | Mon, 13 Jul 2026 18:32:38 +0000 |
| Subject: | Re: Disallow newlines in CURLOPT_HTTPHEADER | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-131902@lists.php.net to get a copy of this message | ||
On Mon, Jul 13, 2026, at 15:27, Tim Düsterhus wrote:
> Though I'm also seeing https://github.com/curl/curl/pull/22309,´F%ΕŽX,Û
> CPN which I
> think concludes the question.
Interesting, thanks. That PR adds a check for newlines in curl. So that makes it clear that headers
are really not supposed to have newlines. But if curl checks this perhaps a check in PHP is not
really adding anything. It could offer better error messages, and include the check even when
someone is using an older curl. Would it still be valuable to include the newline check in PHP?
> > I asked Daniel Stenberg about whether newlines are allowed in headers,
> Did you ask in any publicly logged location so
> that you can provide a link for reference?
No. I emailed him.
Regards,
Sjoerd