When FastHTTP receives a request in which the first header line begins with spaces, it allows the spaces to persist into the header name. This is invalid, because spaces are not permitted in header names.
This can be confirmed by
- running a FastHTTP server that echoes header names (like this one),
- sending it a request with a header name prefixed with spaces, and extracting the echoed header name:
printf 'GET / HTTP/1.1\r\n Test: whatever\r\n\r\n' \
| nc localhost 80 \
| grep "headers" \
| jq '.["headers"][0][0]' \
| xargs echo \
| base64 -d \
| xxd
00000000: 2020 5465 7374 Test
Note that the spaces are still there in the header name.
The correct behavior in this scenario is to reject the request with a 400.
When FastHTTP receives a request in which the first header line begins with spaces, it allows the spaces to persist into the header name. This is invalid, because spaces are not permitted in header names.
This can be confirmed by
Note that the spaces are still there in the header name.
The correct behavior in this scenario is to reject the request with a 400.