Conversation
Collaborator
|
Review requested:
|
nodejs-github-bot
added
http
Add non-throwing counterparts of http.validateHeaderName() and
http.validateHeaderValue() that return a boolean instead of throwing.
Rejecting an invalid header with the existing validators costs a few
microseconds, because an error object and its stack trace are created,
compared to ~20ns for the boolean check. Userland HTTP implementations
such as undici (fetch Headers, request options) therefore keep private
copies of the token and field-value tables from _http_common. These new
functions let them reuse the core implementation.
isValidHeaderValue() accepts an optional `httpValidation` option
('strict' or 'relaxed') that has the same meaning as the option of the
same name on http.createServer() and http.request().
Signed-off-by: James M Snell <jasnell@gmail.com>
Compare http.isValidHeaderName() and http.isValidHeaderValue() with http.validateHeaderName() and http.validateHeaderValue() wrapped in try/catch, for valid and invalid input, and for both 'strict' and 'relaxed' header value validation. Signed-off-by: James M Snell <jasnell@gmail.com>
jasnell
force-pushed
the
jasnell/http-header-validators
branch
from
September 27, 2026 02:42
125da84 to
1b50a1d
Compare
jasnell
added
the
semver-minor
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #66334 +/- ##
==========================================
- Coverage 90.37% 90.36% -0.02%
==========================================
Files 792 792
Lines 275324 275368 +44
Branches 52764 52770 +6
==========================================
+ Hits 248828 248834 +6
- Misses 16918 16960 +42
+ Partials 9578 9574 -4
🚀 New features to boost your workflow:
|
panva
reviewed
Sep 27, 2026
panva
approved these changes
Sep 27, 2026
jasnell
added
request-ci
github-actions
Bot
removed
the
request-ci
Collaborator
jasnell
added
the
commit-queue
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add non-throwing counterparts of http.validateHeaderName() and
http.validateHeaderValue() that return a boolean instead of throwing.
Rejecting an invalid header with the existing validators costs a few
microseconds rather than ~20ns for the boolean check. libraries like
undicikeep private copies of the token and field-value tables from_http_common. This allows them to reuse the core implementations.Keep in mind, this is mostly to improve the performance of the invalid
path.