{"record":{"id":"06ce9fd5957b20ac","repo":"restsharp/RestSharp","slug":"invalid-character-found-in-header-type-value","errorCode":null,"errorMessage":"Invalid character found in header {type}: {value}","messagePattern":"Invalid character found in header (.+?): (.+?)","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/RestSharp/Parameters/HeaderParameter.cs","lineNumber":46,"sourceCode":"    public HeaderParameter(string name, string value, bool encode = false)\n        : base(\n            EnsureValidHeaderString(Ensure.NotEmptyString(name, nameof(name)), \"name\"),\n            EnsureValidHeaderValue(name, value, encode),\n            ParameterType.HttpHeader,\n            false\n        ) { }\n\n    public new string Name  => base.Name!;\n    public new string Value => (string)base.Value!;\n\n    static string EnsureValidHeaderValue(string name, string value, bool encode) {\n        CheckAndThrowsForInvalidHost(name, value);\n\n        return EnsureValidHeaderString(GetValue(Ensure.NotNull(value, nameof(value)), encode), \"value\");\n    }\n\n    static string EnsureValidHeaderString(string value, string type)\n        => !IsInvalidHeaderString(value) ? value : throw new ArgumentException($\"Invalid character found in header {type}: {value}\");\n\n    static string GetValue(string value, bool encode) => encode ? GetBase64EncodedHeaderValue(value) : value;\n\n    static string GetBase64EncodedHeaderValue(string value) => $\"=?UTF-8?B?{Convert.ToBase64String(Encoding.UTF8.GetBytes(value))}?=\";\n\n    static bool IsInvalidHeaderString(string stringValue) {\n        // ReSharper disable once ForCanBeConvertedToForeach\n        for (var i = 0; i < stringValue.Length; i++) {\n            switch (stringValue[i]) {\n                case '\\r':\n                case '\\n':\n                    return true;\n            }\n        }\n\n        return false;\n    }\n","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/restsharp/RestSharp/blob/6a5082169257438cd085f822f050d93256a8e499/src/RestSharp/Parameters/HeaderParameter.cs#L28-L64","documentation":"Thrown by HeaderParameter when the header name or value contains a carriage return (\\r) or line feed (\\n) character. These characters enable HTTP header injection / response-splitting attacks, so the constructor rejects them unless encode=true is used to Base64-wrap the value per RFC 2047.","triggerScenarios":"Constructing a HeaderParameter or calling request.AddHeader(name, value) where value (or name) contains embedded CR/LF characters, e.g. a multi-line user-agent string or untrusted input containing newlines.","commonSituations":"User-supplied input placed in a header without sanitization; multi-line descriptive strings; log-style values with line breaks; data read from files containing Windows-style line endings.","solutions":["Strip or replace CR/LF characters from header values before adding them: value.Replace(\"\\r\", \"\").Replace(\"\\n\", \"\").","If newlines must be preserved, pass encode: true to HeaderParameter to Base64-encode per RFC 2047.","Sanitize all untrusted input used in headers at the trust boundary."],"exampleFix":"// before\nrequest.AddHeader(\"X-Comment\", userInput); // userInput may contain newlines\n\n// after\nvar safe = userInput.Replace(\"\\r\", \" \").Replace(\"\\n\", \" \");\nrequest.AddHeader(\"X-Comment\", safe);","handlingStrategy":"validation","validationCode":"if (value.IndexOfAny(new[] { '\\r', '\\n' }) >= 0) throw new ArgumentException(\"Header value contains CR/LF\", nameof(value));","typeGuard":"static bool IsSafeHeaderValue(string s) => s.IndexOfAny(new[] { '\\r', '\\n' }) < 0;","tryCatchPattern":"try { request.AddHeader(name, value); } catch (ArgumentException ex) when (ex.Message.Contains(\"Invalid character found in header\")) { /* strip CR/LF or pass encode:true */ }","preventionTips":["Strip CR/LF from all untrusted input before placing it in headers.","Pass encode: true to HeaderParameter when newlines must be preserved (RFC 2047).","Treat header values as a trust boundary; sanitize at the source."],"tags":["header","security","header-injection","request"],"backgroundTag":null,"analyzedSha":"6a5082169257438cd085f822f050d93256a8e499","analyzedAt":"2026-08-13T20:38:25.807Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}