Closed nigoroll closed 3 years ago
Good call! What do you think about adapting the writing style from the rest of the document?
Since metadata values can contain arbitrary binary values, Servers SHOULD carefully validate the values or sanitized them before using them as header values to avoid header smuggling.
Thank you, @Acconut . I took your suggestion with minor changes
I just noticed that simplistic implementations might be tempted to use the base64 decode of metadata values directly for headers, which could be used for smuggling.
E.g. consider something along the lines of
if a TUS upload is turned into another HTTP/1.1 request.