nodejs · metcoder95 · May 2, 2025 · May 11, 2025 · May 11, 2025 · May 11, 2025
diff --git a/doc/api/http2.md b/doc/api/http2.md
@@ -2899,6 +2899,10 @@ changes:
     a server should wait when an [`'unknownProtocol'`][] is emitted. If the
     socket has not been destroyed by that time the server will destroy it.
     **Default:** `10000`.
+  * `strictFieldWhitespaceValidation` {boolean} If `true`, it turns on strict leading
+    and trailing whitespace validation for HTTP/2 header field names and values
+    as per [RFC-9113](https://www.rfc-editor.org/rfc/rfc9113.html#section-8.2.1).
+    **Default:** `true`.
   * ...: Any [`net.createServer()`][] option can be provided.
 * `onRequestHandler` {Function} See [Compatibility API][]
 * Returns: {Http2Server}
@@ -3070,6 +3074,10 @@ changes:
     a server should wait when an [`'unknownProtocol'`][] event is emitted. If
     the socket has not been destroyed by that time the server will destroy it.
     **Default:** `10000`.
+  * `strictFieldWhitespaceValidation` {boolean} If `true`, it turns on strict leading
+    and trailing whitespace validation for HTTP/2 header field names and values
+    as per [RFC-9113](https://www.rfc-editor.org/rfc/rfc9113.html#section-8.2.1).
+    **Default:** `true`.
 * `onRequestHandler` {Function} See [Compatibility API][]
 * Returns: {Http2SecureServer}
 
@@ -3225,6 +3233,10 @@ changes:
     a server should wait when an [`'unknownProtocol'`][] event is emitted. If
     the socket has not been destroyed by that time the server will destroy it.
     **Default:** `10000`.
+  * `strictFieldWhitespaceValidation` {boolean} If `true`, it turns on strict leading
+    and trailing whitespace validation for HTTP/2 header field names and values
+    as per [RFC-9113](https://www.rfc-editor.org/rfc/rfc9113.html#section-8.2.1).
+    **Default:** `true`.
 * `listener` {Function} Will be registered as a one-time listener of the
   [`'connect'`][] event.
 * Returns: {ClientHttp2Session}

diff --git a/lib/internal/http2/util.js b/lib/internal/http2/util.js
@@ -229,7 +229,8 @@ const IDX_OPTIONS_MAX_SESSION_MEMORY = 8;
 const IDX_OPTIONS_MAX_SETTINGS = 9;
 const IDX_OPTIONS_STREAM_RESET_RATE = 10;
 const IDX_OPTIONS_STREAM_RESET_BURST = 11;
-const IDX_OPTIONS_FLAGS = 12;
+const IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION = 12;
+const IDX_OPTIONS_FLAGS = 13;
 
 function updateOptionsBuffer(options) {
   let flags = 0;
@@ -293,6 +294,13 @@ function updateOptionsBuffer(options) {
     optionsBuffer[IDX_OPTIONS_STREAM_RESET_BURST] =
       MathMax(1, options.streamResetBurst);
   }
+
+  if (typeof options.strictFieldWhitespaceValidation === 'boolean') {
+    flags |= (1 << IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION);
+    optionsBuffer[IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION] =
+      options.strictFieldWhitespaceValidation === true ? 0 : 1;
+  }
+
   optionsBuffer[IDX_OPTIONS_FLAGS] = flags;
 }
 

diff --git a/src/node_http2.cc b/src/node_http2.cc
@@ -159,6 +159,12 @@ Http2Options::Http2Options(Http2State* http2_state, SessionType type) {
         buffer[IDX_OPTIONS_PEER_MAX_CONCURRENT_STREAMS]);
   }
 
+  // Validate headers in accordance to RFC-9113
+  if (flags & (1 << IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION)) {
+    nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation(
+        option, buffer[IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION]);
+  }
+
   // The padding strategy sets the mechanism by which we determine how much
   // additional frame padding to apply to DATA and HEADERS frames. Currently
   // this is set on a per-session basis, but eventually we may switch to

diff --git a/src/node_http2_state.h b/src/node_http2_state.h
@@ -60,6 +60,7 @@ namespace http2 {
     IDX_OPTIONS_MAX_SETTINGS,
     IDX_OPTIONS_STREAM_RESET_RATE,
     IDX_OPTIONS_STREAM_RESET_BURST,
+    IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION,
     IDX_OPTIONS_FLAGS
   };
 

diff --git a/test/parallel/test-http2-server-rfc-9113-client.js b/test/parallel/test-http2-server-rfc-9113-client.js
@@ -0,0 +1,80 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+const body =
+  '<html><head></head><body><h1>this is some data</h2></body></html>';
+
+const server = http2.createServer((req, res) => {
+  res.setHeader('foobar', 'baz ');
+  res.setHeader('X-POWERED-BY', 'node-test\t');
+  res.setHeader('x-h2-header', '\tconnection-test');
+  res.setHeader('x-h2-header-2', ' connection-test');
+  res.setHeader('x-h2-header-3', 'connection-test ');
+  res.end(body);
+});
+
+const server2 = http2.createServer((req, res) => {
+  res.setHeader('foobar', 'baz ');
+  res.setHeader('X-POWERED-BY', 'node-test\t');
+  res.setHeader('x-h2-header', '\tconnection-test');
+  res.setHeader('x-h2-header-2', ' connection-test');
+  res.setHeader('x-h2-header-3', 'connection-test ');
+  res.end(body);
+});
+
+server.listen(0, common.mustCall(() => {
+  server2.listen(0, common.mustCall(() => {
+    const client = http2.connect(`http://localhost:${server.address().port}`);
+    const client2 = http2.connect(`http://localhost:${server2.address().port}`, { strictFieldWhitespaceValidation: false });
+    const headers = { ':path': '/' };
+    const req = client.request(headers);
+
+    req.setEncoding('utf8');
+    req.on('response', common.mustCall(function(headers) {
+      assert.strictEqual(headers.foobar, undefined);
+      assert.strictEqual(headers['x-powered-by'], undefined);
+      assert.strictEqual(headers['x-powered-by'], undefined);
+      assert.strictEqual(headers['x-h2-header'], undefined);
+      assert.strictEqual(headers['x-h2-header-2'], undefined);
+      assert.strictEqual(headers['x-h2-header-3'], undefined);
+    }));
+
+    let data = '';
+    req.on('data', (d) => data += d);
+    req.on('end', () => {
+      assert.strictEqual(body, data);
+      client.close();
+      client.on('close', common.mustCall(() => {
+        server.close();
+      }));
+
+      const req2 = client2.request(headers);
+      let data2 = '';
+      req2.setEncoding('utf8');
+      req2.on('response', common.mustCall(function(headers) {
+        assert.strictEqual(headers.foobar, 'baz ');
+        assert.strictEqual(headers['x-powered-by'], 'node-test\t');
+        assert.strictEqual(headers['x-h2-header'], '\tconnection-test');
+        assert.strictEqual(headers['x-h2-header-2'], ' connection-test');
+        assert.strictEqual(headers['x-h2-header-3'], 'connection-test ');
+      }));
+      req2.on('data', (d) => data2 += d);
+      req2.on('end', () => {
+        assert.strictEqual(body, data2);
+        client2.close();
+        client2.on('close', common.mustCall(() => {
+          server2.close();
+        }));
+      });
+      req2.end();
+    });
+
+    req.end();
+  }));
+}));
+
+server.on('error', common.mustNotCall());
diff --git a/test/parallel/test-http2-server-rfc-9113-server.js b/test/parallel/test-http2-server-rfc-9113-server.js
@@ -0,0 +1,83 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+const body =
+  '<html><head></head><body><h1>this is some data</h2></body></html>';
+
+const server = http2.createServer((req, res) => {
+  assert.strictEqual(req.headers['x-powered-by'], undefined);
+  assert.strictEqual(req.headers.foobar, undefined);
+  assert.strictEqual(req.headers['x-h2-header'], undefined);
+  assert.strictEqual(req.headers['x-h2-header-2'], undefined);
+  assert.strictEqual(req.headers['x-h2-header-3'], undefined);
+  assert.strictEqual(req.headers['x-h2-header-4'], undefined);
+  res.writeHead(200);
+  res.end(body);
+});
+
+const server2 = http2.createServer({ strictFieldWhitespaceValidation: false }, (req, res) => {
+  assert.strictEqual(req.headers.foobar, 'baz ');
+  assert.strictEqual(req.headers['x-powered-by'], 'node-test\t');
+  assert.strictEqual(req.headers['x-h2-header'], '\tconnection-test');
+  assert.strictEqual(req.headers['x-h2-header-2'], ' connection-test');
+  assert.strictEqual(req.headers['x-h2-header-3'], 'connection-test ');
+  assert.strictEqual(req.headers['x-h2-header-4'], 'connection-test\t');
+  res.writeHead(200);
+  res.end(body);
+});
+
+server.listen(0, common.mustCall(() => {
+  server2.listen(0, common.mustCall(() => {
+    const client = http2.connect(`http://localhost:${server.address().port}`);
+    const client2 = http2.connect(`http://localhost:${server2.address().port}`);
+    const headers = {
+      'foobar': 'baz ',
+      ':path': '/',
+      'x-powered-by': 'node-test\t',
+      'x-h2-header': '\tconnection-test',
+      'x-h2-header-2': ' connection-test',
+      'x-h2-header-3': 'connection-test ',
+      'x-h2-header-4': 'connection-test\t'
+    };
+    const req = client.request(headers);
+
+    req.setEncoding('utf8');
+    req.on('response', common.mustCall(function(headers) {
+      assert.strictEqual(headers[':status'], 200);
+    }));
+
+    let data = '';
+    req.on('data', (d) => data += d);
+    req.on('end', () => {
+      assert.strictEqual(body, data);
+      client.close();
+      client.on('close', common.mustCall(() => {
+        server.close();
+      }));
+
+      const req2 = client2.request(headers);
+      let data2 = '';
+      req2.setEncoding('utf8');
+      req2.on('response', common.mustCall(function(headers) {
+        assert.strictEqual(headers[':status'], 200);
+      }));
+      req2.on('data', (d) => data2 += d);
+      req2.on('end', () => {
+        assert.strictEqual(body, data2);
+        client2.close();
+        client2.on('close', common.mustCall(() => {
+          server2.close();
+        }));
+      });
+      req2.end();
+    });
+
+    req.end();
+  }));
+}));
+
+server.on('error', common.mustNotCall());
diff --git a/test/parallel/test-http2-util-update-options-buffer.js b/test/parallel/test-http2-util-update-options-buffer.js
@@ -25,7 +25,8 @@ const IDX_OPTIONS_MAX_SESSION_MEMORY = 8;
 const IDX_OPTIONS_MAX_SETTINGS = 9;
 const IDX_OPTIONS_STREAM_RESET_RATE = 10;
 const IDX_OPTIONS_STREAM_RESET_BURST = 11;
-const IDX_OPTIONS_FLAGS = 12;
+const IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION = 12;
+const IDX_OPTIONS_FLAGS = 13;
 
 {
   updateOptionsBuffer({
@@ -41,6 +42,7 @@ const IDX_OPTIONS_FLAGS = 12;
     maxSettings: 10,
     streamResetRate: 11,
     streamResetBurst: 12,
+    strictFieldWhitespaceValidation: false
   });
 
   strictEqual(optionsBuffer[IDX_OPTIONS_MAX_DEFLATE_DYNAMIC_TABLE_SIZE], 1);
@@ -55,6 +57,7 @@ const IDX_OPTIONS_FLAGS = 12;
   strictEqual(optionsBuffer[IDX_OPTIONS_MAX_SETTINGS], 10);
   strictEqual(optionsBuffer[IDX_OPTIONS_STREAM_RESET_RATE], 11);
   strictEqual(optionsBuffer[IDX_OPTIONS_STREAM_RESET_BURST], 12);
+  strictEqual(optionsBuffer[IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION], 1);
 
   const flags = optionsBuffer[IDX_OPTIONS_FLAGS];
 
@@ -69,6 +72,7 @@ const IDX_OPTIONS_FLAGS = 12;
   ok(flags & (1 << IDX_OPTIONS_MAX_SETTINGS));
   ok(flags & (1 << IDX_OPTIONS_STREAM_RESET_RATE));
   ok(flags & (1 << IDX_OPTIONS_STREAM_RESET_BURST));
+  ok(flags & (1 << IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION));
 }
 
 {