mochi / mochiweb

MochiWeb is an Erlang library for building lightweight HTTP servers.
Other
1.86k stars 474 forks source link

Remove Whitspaces in header values #246

Closed big-r81 closed 2 years ago

big-r81 commented 2 years ago

Hi,

send a example request with the following header like this:

curl -v --location 'http://127.0.0.1:15984/' --header 'X-Auth-Roles:      test, test2,test3,       test4,    test5     ,        test6     '

*   Trying 127.0.0.1:15984...
* Connected to 127.0.0.1 (127.0.0.1) port 15984 (#0)
> GET / HTTP/1.1
> Host: 127.0.0.1:15984
> User-Agent: curl/7.74.0
> Accept: */*
> X-Auth-Roles:      test, test2,test3,       test4,    test5     ,        test6     

The header is inserted and has the following data:

{"X-Auth-Roles","test, test2,test3,       test4,    test5     ,        test6     "}

RFC 7230 says:

A field value might be preceded and/or followed by optional
whitespace (OWS); a single SP preceding the field-value is preferred
for consistent readability by humans.  The field value does not
include any leading or trailing whitespace: OWS occurring before the
first non-whitespace octet of the field value or after the last
non-whitespace octet of the field value ought to be excluded by
parsers when extracting the field value from a header field.

So, I think the trailing WS from the above example should be defnitly removed before insertion and reading the RFC the ws between the values of the header field should be trimmed with only on ws.

Result should be:

{"X-Auth-Roles","test, test2, test3, test4, test5, test6"}

On insertion (default/3, enter/3, insert/3) in mochiweb_headers.erl, nothing of the input is trimmed.

rnewson commented 2 years ago

leading and trailing OWS should, imo, be removed by mochiweb. Internal whitespace should not be.

big-r81 commented 2 years ago

Ok, thx, then I update my expected result (to be RFC compliant) to

{"X-Auth-Roles","test, test2,test3,       test4,    test5     ,        test6"}