http: add httpValidation option to configure header value validation

Add a new httpValidation option to http.createServer() and
http.request() / http.ClientRequest that controls how strictly
HTTP header values are validated:
- 'strict' - reject any non-ASCII or control characters (default)
- 'relaxed' - allow the non-ASCII characters permitted by the
Fetch specification (kLenientHeaderValueRelaxed)
- 'insecure' - disable all validation (like insecureHTTPParser)
The option is threaded through _storeHeader -> processHeader ->
storeHeader -> validateHeaderValue, and also through
writeInformation -> processInformationHeader -> validateHeaderValue.
Cannot be used together with insecureHTTPParser.
Fixes: #61582
Signed-off-by: RajeshKumar11 <kakumanurajeshkumar@gmail.com>
PR-URL: #61597
Refs: #61582
Refs: https://fetch.spec.whatwg.org/#header-value
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

Author: RajeshKumar11

doc/api/http.md

@@ -3662,6 +3662,9 @@ Found'`.
 <!-- YAML
 added: v0.1.13
 changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/61597
+ description: The `httpValidation` option is supported now.
  - version:
  - v25.1.0
  - v24.12.0
@@ -3718,6 +3721,16 @@ changes:
 `readableHighWaterMark` and `writableHighWaterMark`. This affects
 `highWaterMark` property of both `IncomingMessage` and `ServerResponse`.
  **Default:** See [`stream.getDefaultHighWaterMark()`][].
+ * `httpValidation` {string} Controls HTTP header value validation strictness
+ for incoming requests. Accepted values are:
+ * `'strict'`: Strictest validation; rejects any non-ASCII or control
+ characters in header values.
+ * `'relaxed'`: Allows a limited set of non-ASCII characters in header
+ values, aligning with the
+ [Fetch specification](https://fetch.spec.whatwg.org/).
+ * `'insecure'`: Disables all header value validation (equivalent to
+`insecureHTTPParser:true`).
+ Cannot be used together with `insecureHTTPParser`. **Default:** `'strict'`.
  * `insecureHTTPParser` {boolean} If set to `true`, it will use an HTTP parser
  with leniency flags enabled. Using the insecure parser should be avoided.
  See [`--insecure-http-parser`][] for more information.
@@ -3974,6 +3987,9 @@ This can be overridden for servers and client requests by passing the
 <!-- YAML
 added: v0.3.6
 changes:
+ - version: REPLACEME
+ pr-url: https://github.com/nodejs/node/pull/61597
+ description: The `httpValidation` option is supported now.
  - version:
  - v16.7.0
  - v14.18.0
@@ -4029,6 +4045,16 @@ changes:
  request to. **Default:** `'localhost'`.
  * `hostname` {string} Alias for `host`. To support [`url.parse()`][],
 `hostname` will be used if both `host` and `hostname` are specified.
+ * `httpValidation` {string} Controls HTTP header value validation strictness
+ for outgoing requests. Accepted values are:
+ * `'strict'`: Strictest validation; rejects any non-ASCII or control
+ characters in header values.
+ * `'relaxed'`: Allows a limited set of non-ASCII characters in header
+ values, aligning with the
+ [Fetch specification](https://fetch.spec.whatwg.org/).
+ * `'insecure'`: Disables all header value validation (equivalent to
+`insecureHTTPParser:true`).
+ Cannot be used together with `insecureHTTPParser`. **Default:** `'strict'`.
  * `insecureHTTPParser` {boolean} If set to `true`, it will use an HTTP parser
  with leniency flags enabled. Using the insecure parser should be avoided.
  See [`--insecure-http-parser`][] for more information.

lib/_http_client.js

@@ -46,7 +46,7 @@ const {
  freeParser,
  parsers,
  HTTPParser,
-isLenient,
+calculateLenientFlags,
  prepareError,
  kSkipPendingData,
 }=require('_http_common');
@@ -74,6 +74,7 @@ const {
 codes: {
 ERR_HTTP_HEADERS_SENT,
 ERR_INVALID_ARG_TYPE,
+ERR_INVALID_ARG_VALUE,
 ERR_INVALID_HTTP_TOKEN,
 ERR_INVALID_PROTOCOL,
 ERR_UNESCAPED_CHARACTERS,
@@ -82,6 +83,7 @@ const {
 const{
  validateInteger,
  validateBoolean,
+ validateOneOf,
  validateString,
 }=require('internal/validators');
 const{ getTimerDuration }=require('internal/timers');
@@ -119,9 +121,6 @@ const INVALID_PATH_REGEX = /[^\u0021-\u00ff]/;
 constkError=Symbol('kError');
 constkPath=Symbol('kPath');
 
-constkLenientAll=HTTPParser.kLenientAll|0;
-constkLenientNone=HTTPParser.kLenientNone|0;
-
 constHTTP_CLIENT_TRACE_EVENT_NAME='http.client.request';
 
 functionvalidateHost(host,name){
@@ -299,6 +298,21 @@ function ClientRequest(input, options, cb) {
 
 this.insecureHTTPParser=insecureHTTPParser;
 
+consthttpValidation=options.httpValidation;
+if(httpValidation!==undefined){
+validateOneOf(httpValidation,'options.httpValidation',
+['strict','relaxed','insecure']);
+if(insecureHTTPParser!==undefined){
+thrownewERR_INVALID_ARG_VALUE(
+'options.httpValidation',
+httpValidation,
+'cannot be used together with options.insecureHTTPParser',
+);
+}
+}
+
+this.httpValidation=httpValidation;
+
 if(options.joinDuplicateHeaders!==undefined){
 validateBoolean(options.joinDuplicateHeaders,'options.joinDuplicateHeaders');
 }
@@ -907,12 +921,11 @@ function emitFreeNT(req) {
 functiontickOnSocket(req,socket){
 constparser=parsers.alloc();
 req.socket=socket;
-constlenient=req.insecureHTTPParser===undefined ?
-isLenient() : req.insecureHTTPParser;
+constlenientFlags=calculateLenientFlags(req.httpValidation,req.insecureHTTPParser);
 parser.initialize(HTTPParser.RESPONSE,
 newHTTPClientAsyncResource('HTTPINCOMINGMESSAGE',req),
 req.maxHeaderSize||0,
-lenient ? kLenientAll : kLenientNone);
+lenientFlags);
 parser.socket=socket;
 parser.outgoing=req;
 req.parser=parser;

lib/_http_common.js

@@ -256,17 +256,31 @@ function checkIsHttpToken(val) {
 returntrue;
 }
 
-constheaderCharRegex=/[^\t\x20-\x7e\x80-\xff]/;
+// Strict header value regex per RFC 7230 (original/default behavior):
+// field-value = *( field-content / obs-fold )
+// field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
+// field-vchar = VCHAR / obs-text
+// This rejects control characters (0x00-0x1f except HTAB) and DEL (0x7f).
+conststrictHeaderCharRegex=/[^\t\x20-\x7e\x80-\xff]/;
+
+// Lenient header value regex per Fetch spec (https://fetch.spec.whatwg.org/#header-value):
+// - Must contain no 0x00 (NUL) or HTTP newline bytes (0x0a LF, 0x0d CR)
+// - Must be byte sequences (0x00-0xff), not arbitrary unicode
+// This allows most control characters except NUL, CR, and LF.
+// eslint-disable-next-line no-control-regex
+constlenientHeaderCharRegex=/[\x00\x0a\x0d]|[^\x00-\xff]/;
+
 /**
- * True if val contains an invalid field-vchar
- * field-value = *( field-content / obs-fold )
- * field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
- * field-vchar = VCHAR / obs-text
+ * True if val contains an invalid header value character.
+ * By default uses strict validation per RFC 7230.
+ * When lenient=true, uses relaxed validation per Fetch spec.
  * @param {string} val
+ * @param {boolean} [lenient] - Use lenient validation (Fetch spec rules)
  * @returns {boolean}
  */
-functioncheckInvalidHeaderChar(val){
-returnheaderCharRegex.test(val);
+functioncheckInvalidHeaderChar(val,lenient=false){
+constregex=lenient ? lenientHeaderCharRegex : strictHeaderCharRegex;
+returnregex.test(val);
 }
 
 functioncleanParser(parser){
@@ -300,6 +314,19 @@ function isLenient() {
 returninsecureHTTPParser;
 }
 
+functioncalculateLenientFlags(httpValidation,insecureHTTPParserOption){
+if(httpValidation==='strict'){
+returnHTTPParser.kLenientNone|0;
+}elseif(httpValidation==='relaxed'){
+returnHTTPParser.kLenientHeaderValueRelaxed|0;
+}elseif(httpValidation==='insecure'){
+returnHTTPParser.kLenientAll|0;
+}
+constlenient=insecureHTTPParserOption===undefined ?
+isLenient() : insecureHTTPParserOption;
+returnlenient ? HTTPParser.kLenientAll|0 : HTTPParser.kLenientNone|0;
+}
+
 module.exports={
 _checkInvalidHeaderChar: checkInvalidHeaderChar,
 _checkIsHttpToken: checkIsHttpToken,
@@ -312,6 +339,7 @@ module.exports = {
  kIncomingMessage,
  HTTPParser,
  isLenient,
+ calculateLenientFlags,
  prepareError,
  kSkipPendingData,
 };

lib/_http_outgoing.js

@@ -44,6 +44,7 @@ const {
 _checkIsHttpToken: checkIsHttpToken,
 _checkInvalidHeaderChar: checkInvalidHeaderChar,
 chunkExpression: RE_TE_CHUNKED,
+ isLenient,
 }=require('_http_common');
 const{
  defaultTriggerAsyncIdScope,
@@ -158,6 +159,33 @@ function OutgoingMessage(options) {
 ObjectSetPrototypeOf(OutgoingMessage.prototype,Stream.prototype);
 ObjectSetPrototypeOf(OutgoingMessage,Stream);
 
+// Check if lenient header validation should be used.
+// For ClientRequest: checks this.httpValidation or this.insecureHTTPParser
+// For ServerResponse: checks the server's httpValidation or insecureHTTPParser
+// Falls back to global --insecure-http-parser flag.
+OutgoingMessage.prototype._isLenientHeaderValidation=function(){
+// New httpValidation option takes priority (ClientRequest case)
+if(this.httpValidation!==undefined){
+returnthis.httpValidation!=='strict';
+}
+// ServerResponse: check server's httpValidation option
+constserverHttpValidation=this.req?.socket?.server?.httpValidation;
+if(serverHttpValidation!==undefined){
+returnserverHttpValidation!=='strict';
+}
+// Legacy insecureHTTPParser - ClientRequest has it directly
+if(typeofthis.insecureHTTPParser==='boolean'){
+returnthis.insecureHTTPParser;
+}
+// ServerResponse can access via req.socket.server
+constserverOption=this.req?.socket?.server?.insecureHTTPParser;
+if(typeofserverOption==='boolean'){
+returnserverOption;
+}
+// Fall back to global option
+returnisLenient();
+};
+
 ObjectDefineProperty(OutgoingMessage.prototype,'errored',{
 __proto__: null,
 get(){
@@ -411,32 +439,33 @@ function _storeHeader(firstLine, headers) {
 trailer: false,
 header: firstLine,
 };
+constlenient=this._isLenientHeaderValidation();
 
 if(headers){
 if(headers===this[kOutHeaders]){
 for(constkeyinheaders){
 constentry=headers[key];
-processHeader(this,state,entry[0],entry[1],false);
+processHeader(this,state,entry[0],entry[1],false,lenient);
 }
 }elseif(ArrayIsArray(headers)){
 if(headers.length&&ArrayIsArray(headers[0])){
 for(leti=0;i<headers.length;i++){
 constentry=headers[i];
-processHeader(this,state,entry[0],entry[1],true);
+processHeader(this,state,entry[0],entry[1],true,lenient);
 }
 }else{
 if(headers.length%2!==0){
 thrownewERR_INVALID_ARG_VALUE('headers',headers);
 }
 
 for(letn=0;n<headers.length;n+=2){
-processHeader(this,state,headers[n+0],headers[n+1],true);
+processHeader(this,state,headers[n+0],headers[n+1],true,lenient);
 }
 }
 }else{
 for(constkeyinheaders){
 if(ObjectHasOwn(headers,key)){
-processHeader(this,state,key,headers[key],true);
+processHeader(this,state,key,headers[key],true,lenient);
 }
 }
 }
@@ -535,7 +564,7 @@ function _storeHeader(firstLine, headers) {
 if(state.expect)this._send('');
 }
 
-functionprocessHeader(self,state,key,value,validate){
+functionprocessHeader(self,state,key,value,validate,lenient){
 if(validate)
 validateHeaderName(key);
 
@@ -562,17 +591,17 @@ function processHeader(self, state, key, value, validate) {
 // Retain for(;;) loop for performance reasons
 // Refs: https://github.com/nodejs/node/pull/30958
 for(leti=0;i<value.length;i++)
-storeHeader(self,state,key,value[i],validate);
+storeHeader(self,state,key,value[i],validate,lenient);
 return;
 }
 value=value.join('; ');
 }
-storeHeader(self,state,key,value,validate);
+storeHeader(self,state,key,value,validate,lenient);
 }
 
-functionstoreHeader(self,state,key,value,validate){
+functionstoreHeader(self,state,key,value,validate,lenient){
 if(validate)
-validateHeaderValue(key,value);
+validateHeaderValue(key,value,lenient);
 state.header+=key+': '+value+'\r\n';
 matchHeader(self,state,key,value);
 }
@@ -618,11 +647,11 @@ const validateHeaderName = assignFunctionName('validateHeaderName', hideStackFra
 }
 }));
 
-constvalidateHeaderValue=assignFunctionName('validateHeaderValue',hideStackFrames((name,value)=>{
+constvalidateHeaderValue=assignFunctionName('validateHeaderValue',hideStackFrames((name,value,lenient)=>{
 if(value===undefined){
 thrownewERR_HTTP_INVALID_HEADER_VALUE.HideStackFramesError(value,name);
 }
-if(checkInvalidHeaderChar(value)){
+if(checkInvalidHeaderChar(value,lenient)){
 debug('Header "%s" contains invalid characters',name);
 thrownewERR_INVALID_CHAR.HideStackFramesError('header content',name);
 }
@@ -647,7 +676,13 @@ OutgoingMessage.prototype.setHeader = function setHeader(name, value) {
 thrownewERR_HTTP_HEADERS_SENT('set');
 }
 validateHeaderName(name);
-validateHeaderValue(name,value);
+if(value===undefined){
+thrownewERR_HTTP_INVALID_HEADER_VALUE(value,name);
+}
+if(checkInvalidHeaderChar(value,this._isLenientHeaderValidation())){
+debug('Header "%s" contains invalid characters',name);
+thrownewERR_INVALID_CHAR('header content',name);
+}
 
 letheaders=this[kOutHeaders];
 if(headers===null)
@@ -705,7 +740,13 @@ OutgoingMessage.prototype.appendHeader = function appendHeader(name, value) {
 thrownewERR_HTTP_HEADERS_SENT('append');
 }
 validateHeaderName(name);
-validateHeaderValue(name,value);
+if(value===undefined){
+thrownewERR_HTTP_INVALID_HEADER_VALUE(value,name);
+}
+if(checkInvalidHeaderChar(value,this._isLenientHeaderValidation())){
+debug('Header "%s" contains invalid characters',name);
+thrownewERR_INVALID_CHAR('header content',name);
+}
 
 constfield=name.toLowerCase();
 constheaders=this[kOutHeaders];
@@ -1001,12 +1042,13 @@ OutgoingMessage.prototype.addTrailers = function addTrailers(headers) {
 
 // Check if the field must be sent several times
 constisArrayValue=ArrayIsArray(value);
+constlenient=this._isLenientHeaderValidation();
 if(
 isArrayValue&&value.length>1&&
 (!this[kUniqueHeaders]||!this[kUniqueHeaders].has(field.toLowerCase()))
 ){
 for(letj=0,l=value.length;j<l;j++){
-if(checkInvalidHeaderChar(value[j])){
+if(checkInvalidHeaderChar(value[j],lenient)){
 debug('Trailer "%s"[%d] contains invalid characters',field,j);
 thrownewERR_INVALID_CHAR('trailer content',field);
 }
@@ -1017,7 +1059,7 @@ OutgoingMessage.prototype.addTrailers = function addTrailers(headers) {
 value=value.join('; ');
 }
 
-if(checkInvalidHeaderChar(value)){
+if(checkInvalidHeaderChar(value,lenient)){
 debug('Trailer "%s" contains invalid characters',field);
 thrownewERR_INVALID_CHAR('trailer content',field);
 }