What is the issue with the Fetch Standard?
A header name has to match the field-name syntax (which is token) and does not allow all kind of values such as 0x00.
The specifications do not seem to specify however how to deal with invalid header names.
Should the whole response be discarded (network error)? Should only the invalid header (line) be discarded? Should the Null byte simply be ignored or treated as a space?
Example URL with 0x00: Example
- Chromium:
ERR_INVALID_HTTP_RESPONSE
- Firefox and Safari: load, the invalid header seems to be ignored (it is not visible in devtools in Firefox, it is visible in Safari)
Related: