Skip to content

Commit 6553da9

Browse files
authored
Copy-edit "Validation of Header Names and Values"
1 parent 0b6d9a2 commit 6553da9

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

accepted/PSR-7-http-message-meta.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -656,12 +656,12 @@ Some special characters within the name or value of an HTTP header might affect
656656
the parsing of the serialized message in a way that the contents of unrelated
657657
headers are changed. This misparsing can open up an application to security
658658
vulnerabilities. A common type of vulnerability is CRLF injection, allowing
659-
an attacker to inject additional headers or end the list of headers early.
659+
an attacker to inject additional headers or to end the list of headers early.
660660

661661
For this reason classes implementing the `MessageInterface` SHOULD strictly
662662
validate the header names and contents according to the most recent HTTP
663-
specification ([RFC 7230#3.2][1] at the time of writing). Incorrect values
664-
SHOULD be rejected and no attempt SHOULD be made to automatically correct
663+
specification ([RFC 7230#3.2][1] at the time of writing). The implementation
664+
SHOULD reject invalid values and SHOULD NOT make any attempt to automatically correct
665665
the provided values.
666666

667667
A minimally viable validator is expected to reject header names containing the
@@ -683,7 +683,7 @@ following characters:
683683
- `\n` (0x0A)
684684

685685
If compatibility with older systems is desired then the sequence `\r\n` (0x0D0A)
686-
within a header value may be accepted, if and only if it is preceded by either
686+
within a header value may be accepted if and only if it is preceded by either
687687
SPACE (0x20) or `\t` (0x09).
688688

689689
Further characters or sequences in header values should be rejected according

0 commit comments

Comments
 (0)