Description
The managed HttpListener implementation normalizes malformed request header names by trimming them:
string name = header.AsSpan(0, colon).Trim().ToString();
HTTP requires the field name to be immediately followed by : . A server must reject request messages containing whitespace between the field name and colon with 400 Bad Request. The managed implementation should validate the field name without trimming it. Optional ASCII spaces and tabs around the field value should continue to be removed.
Tests should cover valid headers and malformed names containing leading whitespace or whitespace before the colon.
Reproduction Steps
Send a request containing header : value.
Expected behavior
It should be rejected with 400 Bad Request.
Actual behavior
The request reaches the application with the header normalized to header .
Regression?
No response
Known Workarounds
No response
Configuration
No response
Other information
No response
Description
The managed
HttpListenerimplementation normalizes malformed request header names by trimming them:string name = header.AsSpan(0, colon).Trim().ToString();HTTP requires the field name to be immediately followed by
:. A server must reject request messages containing whitespace between the field name and colon with400 Bad Request. The managed implementation should validate the field name without trimming it. Optional ASCII spaces and tabs around the field value should continue to be removed.Tests should cover valid headers and malformed names containing leading whitespace or whitespace before the colon.
Reproduction Steps
Send a request containing
header : value.Expected behavior
It should be rejected with
400 Bad Request.Actual behavior
The request reaches the application with the header normalized to
header.Regression?
No response
Known Workarounds
No response
Configuration
No response
Other information
No response