{"record":{"id":"b78ea4d911d322be","repo":"bevyengine/bevy","slug":"invalid-header-name","errorCode":null,"errorMessage":"Invalid header name","messagePattern":"Invalid header name","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/bevy_remote/src/http.rs","lineNumber":87,"sourceCode":"    headers: HashMap<HeaderName, HeaderValue>,\n}\n\nimpl Headers {\n    /// Create a new instance of `Headers`.\n    pub fn new() -> Self {\n        Self {\n            headers: HashMap::default(),\n        }\n    }\n\n    /// Insert a key value pair to the `Headers` instance.\n    pub fn insert(\n        mut self,\n        name: impl TryInto<HeaderName>,\n        value: impl TryInto<HeaderValue>,\n    ) -> Self {\n        let Ok(header_name) = name.try_into() else {\n            panic!(\"Invalid header name\")\n        };\n        let Ok(header_value) = value.try_into() else {\n            panic!(\"Invalid header value\")\n        };\n        self.headers.insert(header_name, header_value);\n        self\n    }\n}\n\nimpl Default for Headers {\n    fn default() -> Self {\n        Self::new()\n    }\n}\n\n/// Add this plugin to your [`App`] to allow remote connections over HTTP to inspect and modify entities.\n/// It requires the [`RemotePlugin`](super::RemotePlugin).\n///","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/bevyengine/bevy/blob/396ca727080776bd313bb892423b7d94e03b81b4/crates/bevy_remote/src/http.rs#L69-L105","documentation":"`Headers` is the header map used by bevy_remote's JSON-RPC-over-HTTP transport for the Bevy Remote Protocol (served by `RemoteHttpPlugin`, by default on port 15702). `Headers::insert` is a builder-style method that converts its arguments into `hyper`'s `HeaderName`/`HeaderValue` and panics if a conversion fails, because HTTP header names must be valid tokens. This panic is the name-conversion failure branch.","triggerScenarios":"Calling `headers.insert(name, value)` with a name that is not a valid HTTP token: an empty string, a name containing spaces (e.g. \"Session ID\"), control bytes, non-ASCII characters, or separator characters such as `()<>@,;:\"/[]?={}`.","commonSituations":"Writing custom BRP middleware or response headers (CORS, session/auth headers) where the header name is assembled from user input, contains a space, or was copied from prose with stray whitespace.","solutions":["Fix the name to a valid HTTP token: ASCII letters, digits and hyphens only (e.g. \"Session-Id\")","If the name is dynamic, validate it first with `hyper::header::HeaderName::from_bytes(name.as_bytes())` and skip or log invalid names","Never pass unvalidated user input as a header name; use fixed names and put user data in the value"],"exampleFix":"// before\nlet headers = Headers::new().insert(\"Session ID\", session_id.as_str());\n\n// after\nlet headers = Headers::new().insert(\"Session-Id\", session_id.as_str());","handlingStrategy":"validation","validationCode":"// hyper is already in bevy_remote's dependency tree\nfn valid_header_name(name: &str) -> bool {\n    hyper::header::HeaderName::from_bytes(name.as_bytes()).is_ok()\n}\n\nif valid_header_name(&name) {\n    headers = headers.insert(name, value);\n} else {\n    warn!(\"skipping invalid header name: {name:?}\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat header names as compile-time constants, not data","For dynamic names, run HeaderName::from_bytes before Headers::insert","Remember insert() panics rather than returning a Result; validation must happen on your side"],"tags":["bevy","bevy-remote","brp","http","headers","panic"],"backgroundTag":"invalid-http-header","analyzedSha":"396ca727080776bd313bb892423b7d94e03b81b4","analyzedAt":"2026-08-20T16:12:39.808Z","contentChangedAt":"2026-08-20T16:12:39.808Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}