http: add isValidHeaderName() and isValidHeaderValue() by jasnell · Pull Request #66334 · nodejs/node

jasnell · 2026-09-27T02:37:35Z

Add non-throwing counterparts of http.validateHeaderName() and
http.validateHeaderValue() that return a boolean instead of throwing.

Rejecting an invalid header with the existing validators costs a few
microseconds rather than ~20ns for the boolean check. libraries like
undici keep private copies of the token and field-value tables from
_http_common. This allows them to reuse the core implementations.

Keep in mind, this is mostly to improve the performance of the invalid
path.

http/is_valid_header.js n=1000000 httpValidation="strict" input="valid" method="isValidHeaderName": 53,281,475.53882091
http/is_valid_header.js n=1000000 httpValidation="strict" input="invalid" method="isValidHeaderName": 55,459,748.83943543
http/is_valid_header.js n=1000000 httpValidation="strict" input="valid" method="validateHeaderName": 41,952,415.053701185
http/is_valid_header.js n=1000000 httpValidation="strict" input="invalid" method="validateHeaderName": 345,903.66184467427
http/is_valid_header.js n=1000000 httpValidation="strict" input="valid" method="isValidHeaderValue": 44,726,217.62766685
http/is_valid_header.js n=1000000 httpValidation="relaxed" input="valid" method="isValidHeaderValue": 39,695,759.00037822
http/is_valid_header.js n=1000000 httpValidation="strict" input="invalid" method="isValidHeaderValue": 39,393,631.16861916
http/is_valid_header.js n=1000000 httpValidation="relaxed" input="invalid" method="isValidHeaderValue": 39,331,495.16279641
http/is_valid_header.js n=1000000 httpValidation="strict" input="valid" method="validateHeaderValue": 35,809,327.506200835
http/is_valid_header.js n=1000000 httpValidation="strict" input="invalid" method="validateHeaderValue": 336,332.74856077647

nodejs-github-bot · 2026-09-27T02:37:40Z

Review requested:

@nodejs/http
@nodejs/net
@nodejs/performance

Add non-throwing counterparts of http.validateHeaderName() and http.validateHeaderValue() that return a boolean instead of throwing. Rejecting an invalid header with the existing validators costs a few microseconds, because an error object and its stack trace are created, compared to ~20ns for the boolean check. Userland HTTP implementations such as undici (fetch Headers, request options) therefore keep private copies of the token and field-value tables from _http_common. These new functions let them reuse the core implementation. isValidHeaderValue() accepts an optional `httpValidation` option ('strict' or 'relaxed') that has the same meaning as the option of the same name on http.createServer() and http.request(). Signed-off-by: James M Snell <jasnell@gmail.com>

Compare http.isValidHeaderName() and http.isValidHeaderValue() with http.validateHeaderName() and http.validateHeaderValue() wrapped in try/catch, for valid and invalid input, and for both 'strict' and 'relaxed' header value validation. Signed-off-by: James M Snell <jasnell@gmail.com>

codecov · 2026-09-27T04:30:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.36%. Comparing base (cd908df) to head (1b50a1d).
⚠️ Report is 29 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66334      +/-   ##
==========================================
- Coverage   90.37%   90.36%   -0.02%     
==========================================
  Files         792      792              
  Lines      275324   275368      +44     
  Branches    52764    52770       +6     
==========================================
+ Hits       248828   248834       +6     
- Misses      16918    16960      +42     
+ Partials     9578     9574       -4

Files with missing lines	Coverage Δ
lib/_http_outgoing.js	`97.95% <100.00%> (+0.05%)`	⬆️
lib/http.js	`98.85% <100.00%> (+0.01%)`	⬆️

... and 32 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-09-27T10:59:00Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78000/ 💚

nodejs-github-bot · 2026-09-29T02:54:26Z

Commit Queue failed

This pull request has multiple commits, but no landing policy was selected.

Add commit-queue-squash PRs the Commit Queue should land as one squashed commit. to land it as one commit, or commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. to land the commits separately.

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output

�[36m⠋�[39m Loading data for nodejs/node/pull/66334
�[36m⠋�[39m Loading data for nodejs/node/pull/66334
�[36m⠋�[39m Getting collaborator contacts from README of nodejs/node
�[36m⠋�[39m Getting PR from nodejs/node/pull/66334
�[36m⠋�[39m Getting reviews from nodejs/node/pull/66334
�[36m⠋�[39m Getting comments from nodejs/node/pull/66334
�[36m⠋�[39m Getting commits from nodejs/node/pull/66334
✔  Done loading data for nodejs/node/pull/66334
----------------------------------- PR info ------------------------------------
Title      http: add isValidHeaderName() and isValidHeaderValue() (#66334)
Author     James M Snell <jasnell@gmail.com> (@jasnell)
Branch     jasnell:jasnell/http-header-validators -> nodejs:main
Labels     http, semver-minor, author ready, needs-ci, commit-queue
Commits    2
 - http: add isValidHeaderName() and isValidHeaderValue()
 - benchmark: add http header validator benchmark
Committers 1
 - James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66334
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/66334
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Sun, 27 Sep 2026 02:37:35 GMT
   ✔  Approvals: 3
   ✔  - Filip Skokan (@panva) (TSC): https://github.com/nodejs/node/pull/66334#pullrequestreview-5329924534
   ✔  - Tim Perry (@pimterry): https://github.com/nodejs/node/pull/66334#pullrequestreview-5337659921
   ✔  - Marco Ippolito (@marco-ippolito) (TSC): https://github.com/nodejs/node/pull/66334#pullrequestreview-5341153965
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2026-09-27T10:59:00Z: https://ci.nodejs.org/job/node-test-pull-request/78000/
�[36m⠙�[39m Querying data for job/node-test-pull-request/78000/
�[36m⠙�[39m Querying data for job/node-test-pull-request/78000/
�[36m⠙�[39m Querying API for job/node-test-pull-request/78000/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
�[36m⠹�[39m Bringing origin/main up to date...
�[36m⠹�[39m Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
�[36m⠸�[39m Downloading patch for 66334
�[36m⠸�[39m Downloading patch for 66334
From https://github.com/nodejs/node
 * branch                  refs/pull/66334/merge -> FETCH_HEAD
✔  Fetched commits as e6d47201e15f..1b50a1d4a2a4
--------------------------------------------------------------------------------
[main 4f999af5e0] http: add isValidHeaderName() and isValidHeaderValue()
 Author: James M Snell <jasnell@gmail.com>
 Date: Sun Sep 27 02:18:02 2026 +0000
 4 files changed, 300 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-http-is-valid-header.js
[main abe46365f8] benchmark: add http header validator benchmark
 Author: James M Snell <jasnell@gmail.com>
 Date: Sun Sep 27 02:23:34 2026 +0000
 1 file changed, 120 insertions(+)
 create mode 100644 benchmark/http/is_valid_header.js
   ✔  Patches applied
There are 2 commits in the PR. Attempting autorebase.
(node:501) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
Rebasing (2/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
http: add isValidHeaderName() and isValidHeaderValue()

Add non-throwing counterparts of http.validateHeaderName() and
http.validateHeaderValue() that return a boolean instead of throwing.

Rejecting an invalid header with the existing validators costs a few
microseconds, because an error object and its stack trace are created,
compared to ~20ns for the boolean check. Userland HTTP implementations
such as undici (fetch Headers, request options) therefore keep private
copies of the token and field-value tables from _http_common. These new
functions let them reuse the core implementation.

isValidHeaderValue() accepts an optional `httpValidation` option
('strict' or 'relaxed') that has the same meaning as the option of the
same name on http.createServer() and http.request().

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66334
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
--------------------------------------------------------------------------------
[detached HEAD 86acb31ccb] http: add isValidHeaderName() and isValidHeaderValue()
 Author: James M Snell <jasnell@gmail.com>
 Date: Sun Sep 27 02:18:02 2026 +0000
 4 files changed, 300 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-http-is-valid-header.js
Rebasing (3/4)
Rebasing (4/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
benchmark: add http header validator benchmark

Compare http.isValidHeaderName() and http.isValidHeaderValue() with
http.validateHeaderName() and http.validateHeaderValue() wrapped in
try/catch, for valid and invalid input, and for both 'strict' and
'relaxed' header value validation.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66334
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
--------------------------------------------------------------------------------
[detached HEAD 45f1634a4e] benchmark: add http header validator benchmark
 Author: James M Snell <jasnell@gmail.com>
 Date: Sun Sep 27 02:23:34 2026 +0000
 1 file changed, 120 insertions(+)
 create mode 100644 benchmark/http/is_valid_header.js
Successfully rebased and updated refs/heads/main.
--------------------------------------------------------------------------------
   ℹ  Add `commit-queue-squash` label to land the PR as one commit, or `commit-queue-rebase` to land as separate commits.

View workflow run

Add non-throwing counterparts of http.validateHeaderName() and http.validateHeaderValue() that return a boolean instead of throwing. Rejecting an invalid header with the existing validators costs a few microseconds, because an error object and its stack trace are created, compared to ~20ns for the boolean check. Userland HTTP implementations such as undici (fetch Headers, request options) therefore keep private copies of the token and field-value tables from _http_common. These new functions let them reuse the core implementation. isValidHeaderValue() accepts an optional `httpValidation` option ('strict' or 'relaxed') that has the same meaning as the option of the same name on http.createServer() and http.request(). Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: #66334 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

Compare http.isValidHeaderName() and http.isValidHeaderValue() with http.validateHeaderName() and http.validateHeaderValue() wrapped in try/catch, for valid and invalid input, and for both 'strict' and 'relaxed' header value validation. Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: #66334 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

jasnell · 2026-09-29T04:39:11Z

Landed in 3a30bca...296584b

nodejs-github-bot added http Issues and PRs related to the http subsystem. needs-ci PRs that need a full CI run. labels Sep 27, 2026

jasnell requested review from mcollina and ronag September 27, 2026 02:37

jasnell added 2 commits September 27, 2026 02:42

jasnell force-pushed the jasnell/http-header-validators branch from 125da84 to 1b50a1d Compare September 27, 2026 02:42

jasnell added the semver-minor PRs that contain new features and should be released in the next minor version. label Sep 27, 2026

panva reviewed Sep 27, 2026

View reviewed changes

Comment thread lib/_http_outgoing.js

panva approved these changes Sep 27, 2026

View reviewed changes

jasnell added request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. author ready PRs with CI started, the required approvals, and no outstanding review comments. labels Sep 27, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 27, 2026

jasnell added the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 27, 2026

pimterry approved these changes Sep 28, 2026

View reviewed changes

marco-ippolito approved these changes Sep 28, 2026

View reviewed changes

nodejs-github-bot added commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. labels Sep 29, 2026

jasnell closed this Sep 29, 2026

Navigation Menu

Uh oh!

http: add isValidHeaderName() and isValidHeaderValue() - #66334

http: add isValidHeaderName() and isValidHeaderValue()#66334
jasnell wants to merge 2 commits into
nodejs:mainfrom
jasnell:jasnell/http-header-validators

jasnell commented Sep 27, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Sep 27, 2026

Uh oh!

codecov Bot commented Sep 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

nodejs-github-bot commented Sep 27, 2026 •

edited by jasnell

Loading

Uh oh!

nodejs-github-bot commented Sep 29, 2026

Uh oh!

jasnell commented Sep 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

jasnell commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Sep 27, 2026

Uh oh!

codecov Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

nodejs-github-bot commented Sep 27, 2026 • edited by jasnell Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Sep 29, 2026

Commit Queue failed

Uh oh!

jasnell commented Sep 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jasnell commented Sep 27, 2026 •

edited

Loading

codecov Bot commented Sep 27, 2026 •

edited

Loading

nodejs-github-bot commented Sep 27, 2026 •

edited by jasnell

Loading