fix: preserve Unicode headers for request interceptors by cyphercodes · Pull Request #10850 · axios/axios

cyphercodes · 2026-05-06T03:21:09Z

Summary

Preserves Unicode request header values until request interceptors run, so callers can encode values such as Chinese names before the request is sent. The Node HTTP adapter still strips unencoded characters that Node cannot accept right before building the request options.

Linked issue

Fixes #10849

Changes

Keep non-control Unicode characters in AxiosHeaders normalization so interceptors can transform them.
Sanitize Node outbound header values to Node-compatible bytes before passing them to http.request.
Add HTTP adapter regression coverage for interceptor encoding and unencoded Unicode sanitization.

Checklist

Tests added or updated (or N/A with reason)
Docs / types updated if public API changed (index.d.ts and index.d.cts) — N/A, no public API or type changes
No breaking changes (or called out explicitly above)

Summary by cubic

Preserves non-control Unicode header values until request interceptors run, then sanitizes to byte‑safe values in http, fetch, and xhr right before sending. Centralizes faster regex-based sanitization in helpers/sanitizeHeaderValue.js.

Description

Summary of changes
- Keep non-control Unicode during AxiosHeaders normalization; still strip CR/LF to prevent injection.
- Add helpers/sanitizeHeaderValue.js with sanitizeHeaderValue, sanitizeByteStringHeaderValue, and toByteStringHeaderObject.
- Use toByteStringHeaderObject in http, fetch, and xhr adapters at send time.
- Improve performance by using regex-based sanitization and sharing logic across adapters.
Reasoning
- Lets interceptors encode values (e.g., Chinese names) while keeping adapters compliant with Node and browser header rules.
Additional context
- Fixes V1.16.0 custom request header attributes do not support Chinese. #10849.
- No public API changes.

Docs

Docs updated in /docs/pages/advanced/headers.md with a new “Unicode header values” section, explaining preservation in AxiosHeaders, adapter sanitization, and an interceptor example using encodeURIComponent. No further changes needed.

Testing

Added tests:
- http and fetch adapters: interceptor-encoded Unicode headers reach the server encoded; unencoded Unicode headers are sanitized to empty byte-safe values.
- Browser xhr: same coverage as above.
- AxiosHeaders: preserves non-control Unicode; still strips CR/LF to prevent header injection.
Coverage is sufficient; no additional tests needed.

Semantic version impact

Patch: internal bug fix and performance improvement with no breaking changes.

^{Written for commit e70b317. Summary will update on new commits.}

cubic-dev-ai

1 issue found across 3 files

Confidence score: 3/5

There is a concrete regression risk in lib/core/AxiosHeaders.js: preserving non-Latin1 Unicode header values can reach browser platform APIs that may reject them and throw when requests are sent.
The issue is moderately severe (7/10) with fairly high confidence (8/10), so this is more than a cosmetic concern and could impact real user requests at runtime.
Pay close attention to lib/core/AxiosHeaders.js - header sanitization changes may allow invalid browser header values that trigger request-time failures.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/core/AxiosHeaders.js">

<violation number="1" location="lib/core/AxiosHeaders.js:45">
P1: Header sanitization now preserves non-Latin1 Unicode values, but browser adapters pass them through to platform APIs that may reject them and throw at request time.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cyphercodes · 2026-05-06T03:47:42Z

Pushed a follow-up for the browser-adapter concern:

keeps Unicode header values available inside AxiosHeaders so request interceptors can encode them
sanitizes final adapter-bound header objects for HTTP, XHR, and fetch before platform APIs receive them
adds XHR/fetch regressions in addition to the HTTP adapter coverage

Local verification:

npx vitest run --project unit tests/unit/adapters/fetch.test.js -t "headers containing CRLF|Unicode"
npx vitest run --project unit tests/unit/adapters/http.test.js -t "headers containing CRLF|Unicode"
xvfb-run -a npx vitest run --project browser tests/browser/headers.browser.test.js -t "Unicode"
npx eslint lib/helpers/sanitizeHeaderValue.js lib/core/AxiosHeaders.js lib/adapters/http.js lib/adapters/xhr.js tests/browser/headers.browser.test.js tests/unit/adapters/fetch.test.js
git diff --check

cubic-dev-ai

1 issue found across 7 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/adapters/fetch.js">

<violation number="1" location="lib/adapters/fetch.js:288">
P2: Sanitized headers can still be overridden by the second `fetchOptions` argument when `Request` is used, defeating the new header sanitization and allowing invalid header values to re-enter the request.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-05-06T03:53:02Z

        signal: composedSignal,
        method: method.toUpperCase(),
-        headers: headers.normalize().toJSON(),
+        headers: toByteStringHeaderObject(headers.normalize()),


P2: Sanitized headers can still be overridden by the second fetchOptions argument when Request is used, defeating the new header sanitization and allowing invalid header values to re-enter the request.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/adapters/fetch.js, line 288: <comment>Sanitized headers can still be overridden by the second `fetchOptions` argument when `Request` is used, defeating the new header sanitization and allowing invalid header values to re-enter the request.</comment> <file context> @@ -284,7 +285,7 @@ const factory = (env) => { signal: composedSignal, method: method.toUpperCase(), - headers: headers.normalize().toJSON(), + headers: toByteStringHeaderObject(headers.normalize()), body: data, duplex: 'half', </file context>

jasonsaayman

lib/helpers/sanitizeHeaderValue.js:32-43: Please replace per-char concat with a regex pass for both isValidUnicodeHeaderValueChar and isValidByteStringHeaderValueChar. Same semantics but faster, and matches the prior implementation.
Can you please add a positive regression test to axiosHeaders.test.js that checks that set('x', '请求用户') roundtrips through get('x' is unchanged. Will guard against future refactoring of normalizeValue that could silently break #10849.
Would it be possible to add to /docs/ in the English docs a note about this preservation.

cyphercodes · 2026-05-06T15:47:53Z

Pushed a small follow-up for the requested sanitizer implementation change.

What changed:

Replaced the per-character header-value sanitizer loop with regex-based passes for the Unicode-preserving and ByteString/platform-bound sanitizer paths.
Kept the same trimming/control-character semantics; the intentional control-code regex ranges are documented for ESLint.

Local verification:

npm ci ✅
npx vitest run --project unit tests/unit/adapters/http.test.js -t "headers containing CRLF|Unicode" ✅
npx vitest run --project unit tests/unit/adapters/fetch.test.js -t "headers containing CRLF|Unicode" ✅
npx eslint lib/helpers/sanitizeHeaderValue.js lib/core/AxiosHeaders.js lib/adapters/http.js lib/adapters/xhr.js tests/unit/adapters/fetch.test.js ✅
git diff --check ✅

fix: preserve Unicode headers for request interceptors

591b07b

cyphercodes requested a review from jasonsaayman as a code owner May 6, 2026 03:21

cubic-dev-ai Bot reviewed May 6, 2026

View reviewed changes

Comment thread lib/core/AxiosHeaders.js Outdated

fix: sanitize adapter-bound header values

1a8fa4e

cubic-dev-ai Bot reviewed May 6, 2026

View reviewed changes

jasonsaayman assigned cyphercodes May 6, 2026

jasonsaayman added priority::medium A medium priority commit::fix The PR is related to a bugfix labels May 6, 2026

jasonsaayman requested changes May 6, 2026

View reviewed changes

jasonsaayman added the status::changes-requested A reviewer requested changes to the PR label May 6, 2026

perf: use regex header value sanitization

da70e69

jasonsaayman added 3 commits May 6, 2026 18:52

Merge branch 'v1.x' into fix/unicode-header-interceptor-sanitization

df8dda9

chore: added tests to cover regression cases

603bf6a

docs: update with latest changes

e70b317

jasonsaayman approved these changes May 6, 2026

View reviewed changes

jasonsaayman merged commit cabead5 into axios:v1.x May 6, 2026
23 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: preserve Unicode headers for request interceptors#10850

fix: preserve Unicode headers for request interceptors#10850
jasonsaayman merged 6 commits into
axios:v1.xfrom
cyphercodes:fix/unicode-header-interceptor-sanitization

cyphercodes commented May 6, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

cyphercodes commented May 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot May 6, 2026

Uh oh!

jasonsaayman left a comment •

edited

Loading

Uh oh!

cyphercodes commented May 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

cyphercodes commented May 6, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked issue

Changes

Checklist

Summary by cubic

Description

Docs

Testing

Semantic version impact

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cyphercodes commented May 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

jasonsaayman left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cyphercodes commented May 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cyphercodes commented May 6, 2026 •

edited by cubic-dev-ai Bot

Loading

jasonsaayman left a comment •

edited

Loading