HTTP Header names cannot start with non-alpha char

According to rfc2616, header field names are defined by a token in the RFC's BNF http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2

The token is defined in http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2 to permit any non-control character and non-separator character. The relevant details are:

token          = 1*<any CHAR except CTLs or separators>
CHAR           = <any US-ASCII character (octets 0 - 127)>
separators     = "(" | ")" | "<" | ">" | "@"
                      | "," | ";" | ":" | "\" | <">
                      | "/" | "[" | "]" | "?" | "="
                      | "{" | "}" | SP | HT
CTL            = <any US-ASCII control character
                        (octets 0 - 31) and DEL (127)>
SP             = <US-ASCII SP, space (32)>
HT             = <US-ASCII HT, horizontal-tab (9)>

The current implementation of HeaderFieldName restricts header names more than the spec:

// Check for valid syntax: must begin with letter, then only word and dash chars allowed
if (! nameTrimmed.matches("^[a-zA-Z][\\w-]*$"))
    throw new IllegalArgumentException("The header field name has invalid syntax");

This means that the filter cannot be configured properly to use some header names. I have an application that uses such headers, which start with an underscore character.

I'll create a pull request if you're interested in fixing this.

Comments (6)