# std.http: assert against \\r\\n in headers · gitcafe/zig

[View on GitCafe](https://git.cafe/gitcafe/zig/commit/10beb19ce7804f9669f25a6b5d80e7eef3fdc14f)

Repository: [gitcafe/zig](https://git.cafe/gitcafe/zig)

Visibility: public

Requested revision: 10beb19ce7804f9669f25a6b5d80e7eef3fdc14f

Requested commit: 10beb19ce7804f9669f25a6b5d80e7eef3fdc14f

Commit: 10beb19ce7804f9669f25a6b5d80e7eef3fdc14f

Tree: 17f59b46250bc7e2689d8fb1ce78fb990fb51176

Author: Andrew Kelley

Committer: Andrew Kelley

## Message

```
std.http: assert against \r\n in headers

The HTTP specification does not provide a way to escape \r\n in headers,
so it's the API user's responsibility to ensure the header names and
values do not contain \r\n. Also header names must not contain ':'.

It's an assertion, not an error, because the calling code very likely is
using hard-coded values or server-provided values that do not need to be
checked, and the error would be unreachable anyway.

Untrusted user input must not be put directly into into HTTP headers.

```

## Parents

- [d051b1396358d1b9229aefeeb2a61f7f46a4e5c3](https://git.cafe/gitcafe/zig/commit/d051b1396358d1b9229aefeeb2a61f7f46a4e5c3?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zig/tree/10beb19ce7804f9669f25a6b5d80e7eef3fdc14f?format=markdown)