René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Allow multiple single-value headers in HTTP/2 with a new insecure parser option","articleBody":"### What is the problem this feature will solve?\n\nHTTP/2 includes restrictions that block any attempt to send multiple values of known single-values headers in requests or responses ([here](https://github.com/nodejs/node/blob/83c955d8c26087ada9ab54bbd75c6497125d9812/lib/internal/http2/util.js#L785-L789)). \n\nThis restriction doesn't exist in our HTTP/1 implementation:\n\n```js\nconst http = require('http');\n\nhttp.createServer((req, res) =\u003e {\n    res.writeHead(200, { date: ['a', 'b'] });\n    res.end();\n}).listen(9000);\n```\n\nThis sends two `date` headers in the response with no problem at all.\n\nBlocking this is a reasonable default imo (normal applications shouldn't send multiple single-value headers) but is problematic as a hard restriction, because there do exist real clients and servers that do all sorts of technically-invalid-but-parseable things like this. Clients \u0026 servers in Node.js that need to integrate, proxy or emulate these behaviours run into problems when that's blocked (in my case: https://github.com/httptoolkit/httptoolkit/issues/785).\n\n### What is the feature you are proposing to solve the problem?\n\nI'd suggest we add an option to disable this restriction. Technically this appears very easy to do, the question is the API and whether we're happy to do it.\n\nWe do currently already have one insecure funky parsing option for HTTP/2 servers and clients: `strictFieldWhitespaceValidation`.\n\nWe could either add a new option like `strictSingleValueHeaderValidation` defaulting to true, or we could move towards a more general `insecureHTTPParser` option, just like HTTP/1 (potentially sharing the same --insecure-http-parser CLI option) to allow users to explicitly opt into all of those kinds of insecure settings at once (I think most users who want one kind of insecure validation are likely to want all of them - does that seem plausible?). That would allow users to indicate they want to be able to send \u0026 receive content without any validation that's not strictly required for parsing/generating output. In the latter case, I imagine we'd slowly deprecate `strictFieldWhitespaceValidation` and move towards a world where we maintain a single option.\n\n### What alternatives have you considered?\n\nCurrently there's no alternatives - it's impossible to send these requests or responses with Node unless you reimplement HTTP/2 from scratch.\n\nOpening this issue to collect opinions on the options and concept generally here, particularly from @jasnell, @apapirovski and @mildsunrise who've touched on this code in the past.","author":{"url":"https://github.com/pimterry","@type":"Person","name":"pimterry"},"datePublished":"2025-08-27T17:56:55.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/59651/node/issues/59651"}