Class DefaultHttpHeaders

    • Constructor Detail

      • DefaultHttpHeaders

        public DefaultHttpHeaders()
        Create a new, empty HTTP headers object.

        Header names and values are validated as they are added, to ensure they are compliant with the HTTP protocol.

      • DefaultHttpHeaders

        @Deprecated
        public DefaultHttpHeaders​(boolean validate)
        Deprecated.
        Prefer using the DefaultHttpHeaders() constructor instead, to always have validation enabled.
        Warning! Setting validate to false will mean that Netty won't validate & protect against user-supplied header values that are malicious. This can leave your server implementation vulnerable to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') . When disabling this validation, it is the responsibility of the caller to ensure that the values supplied do not contain a non-url-escaped carriage return (CR) and/or line feed (LF) characters.
        Parameters:
        validate - Should Netty validate header values to ensure they aren't malicious.
      • DefaultHttpHeaders

        protected DefaultHttpHeaders​(boolean validateValues,
                                     io.netty.handler.codec.DefaultHeaders.NameValidator<CharSequence> nameValidator)
        Create an HTTP headers object with the given name validator.

        Warning! It is strongly recommended that the name validator implement validation that is at least as strict as HttpHeaderValidationUtil.validateToken(CharSequence). It is also strongly recommended that validateValues is enabled.

        Without these validations in place, your code can be susceptible to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') . It is the responsibility of the caller to ensure that the values supplied do not contain a non-url-escaped carriage return (CR) and/or line feed (LF) characters.

        Parameters:
        validateValues - Should Netty validate header values to ensure they aren't malicious.
        nameValidator - The DefaultHeaders.NameValidator to use, never {@code null.
      • DefaultHttpHeaders

        protected DefaultHttpHeaders​(io.netty.handler.codec.DefaultHeaders<CharSequence,​CharSequence,​?> headers)