Closed Mumeii closed 3 years ago
You should consider using llhttp. It has very similar API to http_parser and was used in Node.js for some time now. In addition to the error codes that http_parser provides, llhttp also provides a error description
field, which contains a detailed error, and a error_pos
field, which holds the offset to offending character.
Since the parsing is stricter, the
Invalid header value char
error message occur much more often, which is a good thing 👍But on the other hand, the error message is too terse and can't really help spotting which part of header is causing trouble.
I'm right now in a case where our in house Identity Federation system seems to produce randomly such an invalid header answers when calling it to fetch an OAuth2 JWT thru Postman.
I'd love to notify them they have such a trouble, but can't really tell which is the culprit part of it ...
Having the error message being more explicit would greatly help having a fast analysis and thus a faster security enhancement !