Skip to content

http: add strictMode option and checkIsHttpToken check

Rodrigo Muino Tomonari requested to merge github/fork/jasnell/sanitize-headers into master

Per: https://github.com/nodejs/node-convergence-archive/issues/13

Adds a check that will cause a TypeError to be thrown if the HTTP method or header field name does not conform to the Token rule.

This adds a new strictMode flag to OutgoingMessage that, when enabled, will cause a TypeError to be thrown if the HTTP Method or header field name does not conform to the Token rule.

The strictMode flag ensures that, in the common case, there is minimal performance hit and that existing code should continue to work. The Token check is only performed when strictMode = true.

Doc and test case are included.

On the client-side

var http = require('http');
var url = require('url');
var p = url.parse('http://localhost:8888');
p.headers = {'testing 123': 123};
p.strictMode = true;
http.client(p, function(res) { }); // throws

On the server-side

var http = require('http');
var server = http.createServer(function(req,res) {
  res.strictMode = true;
  res.setHeader('testing 123', 123); // throws
  res.end('...');
});

Merge request reports