Description
Audit a supplied HTTP field value for forbidden controls or non-Latin-1 code units, retaining exact UTF-16 positions; does not repair or parse a message.
HTTP field names are case-insensitive, while values follow each field’s own grammar. Repeated occurrences sometimes form lists but cannot always be combined. Quoted values, optional spaces/tabs and quality weights need their own treatment; the tools here use explicit field records or a stated text subset.1
Audit a supplied HTTP field value for forbidden controls or non-Latin-1 code units, retaining exact UTF-16 positions; does not repair or parse a message.
When to use this tool
Use this tool to audit a supplied HTTP field value for forbidden controls or non-Latin-1 code units, retaining exact UTF-16 positions; does not repair or parse a message.
How to use the tool and how it works
- Enter value using the field definitions below.
- Run the operation. Correct input errors before interpreting an output.
- Read result.violations. Use the ordering, boundary rules and absence conditions described below.
Report UTF-16 positions whose code units are C0 other than tab, DEL, or above 255.2
| Input field | Meaning and units | Accepted input |
|---|---|---|
| value | Field-value text under the stated supported character and splitting rules. | Text, at most 8,192 UTF-16 code units; the operation’s grammar also applies. |
| Output field | Interpretation |
|---|---|
| result | Object containing the named fields below. |
| result.violations | Original indexes of forbidden field-value code units or repeated caller-declared singleton groups. |
{
"input": {
"value": "a\r\nb"
},
"output": {
"result": {
"violations": [
{
"index": 1,
"code": 13
},
{
"index": 2,
"code": 10
}
]
}
}
}Limitations and assumptions
- This audits the supported single-byte field-value character range, not full header grammar or request-smuggling safety.
- Explicit header records have name and value strings. Names must use token syntax; supported value code units are tab or 32–255 excluding DEL. Byte budgets use that single-byte representation, not UTF-8 or HTTP/2 compression.
- Every declared top-level input field is required and unexpected fields are rejected. Ordinary strings are limited to 8,192 UTF-16 code units and lists to 128 entries, with tighter operation-specific bounds where stated. JSON text has bounded nesting and node counts.
- Numeric outputs must be finite and no larger in absolute magnitude than the safe-integer limit; operations returning exact large integers use decimal text. Positions are zero-based and spans end exclusively unless the operation explicitly states a different convention.
Alternative or Complementary methods
Choose field-specific parsing and combination rules rather than applying one policy to every header. Preserve occurrence order and use a full HTTP implementation for message framing and protocol-level decisions.
References
-
RFC 9110: HTTP Semantics — RFC Editor
-
Tool behavior and example: HTTP Header Value Control Character Audit — tool.io
Similar or alternative tools
- HTTP Header Occurrence Value Redaction
Redact complete supplied HTTP field values by explicit case-insensitive names without modifying occurrence order; not a guarantee that sensitive data is absent elsewhere.
- HTTP Header Parameter Repeated Value Groups
Group repeated exact decoded HTTP parameter values by case-insensitive name plus case-sensitive value, reusing the existing parameter parser.