Skip to content

Header Validation ## Business Purpose

Ensure that HTTP request headers conform to RFC standards, rejecting invalid characters and formats to prevent header injection attacks. ## Current Behaviors - check_header_validity validates header name and value against compiled regex patterns src/requests/utils.py:1087. - _validate_header_part matches against HEADER_VALIDATORS dict which contains patterns for bytes and str src/requests/_internal_utils.py:19. - InvalidHeader exception is raised on mismatch src/requests/utils.py:1098. - Headers are stored in a CaseInsensitiveDict, enabling case-insensitive access src/requests/models.py:422. - Setting a header to None removes it from the dict src/requests/models.py:422. ## Technical Implementation During PreparedRequest.prepare_headers(), each header key and value is validated via check_header_validity. The headervalue regex pattern is defined in _internal_utils.py. ## Definition of Done - A header key containing a colon raises InvalidHeader. - A header value containing carriage return or newline raises InvalidHeader. - A header value that is an integer is converted to a string and accepted. - A header with leading whitespace in the key is rejected. - CaseInsensitiveDict returns the correct value regardless of case.