{"record":{"id":"a2916691b5e790f0","repo":"valyala/fasthttp","slug":"fasthttp-contain-forbidden-trailer","errorCode":null,"errorMessage":"fasthttp: contain forbidden trailer","messagePattern":"fasthttp: contain forbidden trailer","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"header.go","lineNumber":469,"sourceCode":"//\n// Trailers are only supported with chunked transfer.\n// Trailers allow the sender to include additional headers at the end of chunked messages.\n//\n// The following trailers are forbidden:\n// 1. necessary for message framing (e.g., Transfer-Encoding and Content-Length),\n// 2. routing (e.g., Host),\n// 3. request modifiers (e.g., controls and conditionals in Section 5 of [RFC7231]),\n// 4. authentication (e.g., see [RFC7235] and [RFC6265]),\n// 5. response control data (e.g., see Section 7.1 of [RFC7231]),\n// 6. determining how to process the payload (e.g., Content-Encoding, Content-Type, Content-Range, and Trailer)\n//\n// Return ErrBadTrailer if contain any forbidden trailers.\nfunc (h *header) AddTrailer(trailer string) error {\n\treturn h.AddTrailerBytes(s2b(trailer))\n}\n\nvar (\n\tErrBadTrailer                    = errors.New(\"fasthttp: contain forbidden trailer\")\n\tErrReadingResponseHeaders        = errors.New(\"fasthttp: error when reading response headers\")\n\tErrReadingResponseTrailer        = errors.New(\"fasthttp: error when reading response trailer\")\n\tErrResponseFirstLineMissingSpace = errors.New(\"fasthttp: cannot find whitespace in the first line of response\")\n\tErrUnexpectedStatusCodeChar      = errors.New(\"fasthttp: unexpected char at the end of status code\")\n\tErrMissingRequestMethod          = errors.New(\"fasthttp: cannot find http request method\")\n\tErrUnsupportedRequestMethod      = errors.New(\"fasthttp: unsupported http request method\")\n\tErrExtraWhitespaceInRequestLine  = errors.New(\"fasthttp: extra whitespace in request line\")\n\tErrEmptyRequestURI               = errors.New(\"fasthttp: requesturi cannot be empty\")\n\tErrDuplicateContentLength        = errors.New(\"fasthttp: duplicate content-length header\")\n\tErrUnsupportedTransferEncoding   = errors.New(\"fasthttp: unsupported transfer-encoding\")\n\tErrNonNumericChars               = errors.New(\"fasthttp: non-numeric chars found\")\n\tErrNeedMore                      = errors.New(\"fasthttp: need more data: cannot find trailing lf\")\n\tErrSmallReadBuffer               = errors.New(\"fasthttp: small read buffer. increase readbuffersize\")\n)\n\n// AddTrailerBytes add Trailer header value for chunked response\n// to indicate which headers will be sent after the body.\n//","sourceCodeStart":451,"sourceCodeEnd":487,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/header.go#L451-L487","documentation":"ErrBadTrailer is returned by header.AddTrailer when the supplied trailer name is in the forbidden set (e.g. hop-by-hop or pseudo headers like Content-Length, Transfer-Encoding, Host) and may not be sent as an HTTP trailer. The library validates trailer names to keep the response well-formed per RFC 7230.","triggerScenarios":"Calling Response.Header.AddTrailer(name) or AddTrailerBytes with a forbidden header name; also surfaced by TestExportedErrorStrings when validating exported error messages.","commonSituations":"Copying all upstream response headers into trailers when proxying; hand-building chunked responses and accidentally including Content-Length/Transfer-Encoding/Host as trailers.","solutions":["Remove the forbidden trailer from the list before calling AddTrailer","Filter headers with an allowlist (e.g. only custom X- headers) when proxying trailers","Send the value as a normal response header instead of a trailer","Normalize header names (trim spaces, canonical case) before validation"],"exampleFix":"// before\nresp.Header.AddTrailer(\"Content-Length\") // forbidden\n// after\nresp.Header.AddTrailer(\"X-Checksum-CRC32\") // allowed trailer","handlingStrategy":"validation","validationCode":"var forbidden = map[string]bool{\"content-length\": true, \"transfer-encoding\": true, \"host\": true}\nif forbidden[strings.ToLower(strings.TrimSpace(name))] {\n    return fmt.Errorf(\"trailer %q is forbidden\", name)\n}","typeGuard":null,"tryCatchPattern":"if err := resp.Header.AddTrailer(name); err != nil {\n    if errors.Is(err, fasthttp.ErrBadTrailer) {\n        // send as a normal header instead\n        resp.Header.Set(name, value)\n    }\n}","preventionTips":["Maintain an allowlist of trailer names rather than forwarding everything","Never put Content-Length, Transfer-Encoding, or Host in trailers","Normalize (trim/lowercase) header names before validating","Consult RFC 7230 §4.1.2 for the disallowed trailer set"],"tags":["go","fasthttp","http","headers","trailer"],"backgroundTag":"forbidden-http-trailer","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}