Re: Disallow newlines in CURLOPT_HTTPHEADER

Hi Jorg, Matteo, I wrote earlier: > It seems to me that this is exactly a case where this policy applies: > https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy and: > I asked Daniel Stenberg about whether newlines are allowed in headers, > and he said: > > > The documentation says in clear terms: > > > > The headers included in the linked list must not be CRLF-terminated > > > > I believe libcurl might change its treatment of them in a future and > > start > > returning error earlier when such octets are found. On Mon, Jul 13, 2026, at 15:27, Tim Düsterhus wrote: > Though I'm also seeing > https://github.com/curl/curl/pull/22309, which I > think concludes the question. Given that Daniel Stenberg has said that newlines are not permitted, and is currently developing a pull request to reject them, does this change your view on whether PHP should reject newlines in headers passed to curl? Do you think I still need an RFC for this functionality? Regards, Sjoerd Langkemper