{"record":{"id":"b9dcd5ac844657e3","repo":"seanmonstar/warp","slug":"illegal-header","errorCode":null,"errorMessage":"illegal Header","messagePattern":"illegal Header","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/filters/cors.rs","lineNumber":128,"sourceCode":"        });\n        self.methods.extend(iter);\n        self\n    }\n\n    /// Adds a header to the list of allowed request headers.\n    ///\n    /// **Note**: These should match the values the browser sends via `Access-Control-Request-Headers`, e.g. `content-type`.\n    ///\n    /// # Panics\n    ///\n    /// Panics if the provided argument is not a valid `http::header::HeaderName`.\n    pub fn allow_header<H>(mut self, header: H) -> Self\n    where\n        HeaderName: TryFrom<H>,\n    {\n        let header = match TryFrom::try_from(header) {\n            Ok(m) => m,\n            Err(_) => panic!(\"illegal Header\"),\n        };\n        self.allowed_headers.insert(header);\n        self\n    }\n\n    /// Adds multiple headers to the list of allowed request headers.\n    ///\n    /// **Note**: These should match the values the browser sends via `Access-Control-Request-Headers`, e.g.`content-type`.\n    ///\n    /// # Panics\n    ///\n    /// Panics if any of the headers are not a valid `http::header::HeaderName`.\n    pub fn allow_headers<I>(mut self, headers: I) -> Self\n    where\n        I: IntoIterator,\n        HeaderName: TryFrom<I::Item>,\n    {\n        let iter = headers.into_iter().map(|h| match TryFrom::try_from(h) {","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/seanmonstar/warp/blob/ff34d7213ed55ec342304aa7ff6ac4b351da9e66/src/filters/cors.rs#L110-L146","documentation":"The `allow_header` builder converts the given value into `http::HeaderName` and panics with \"illegal Header\" if conversion fails. Header names must be valid lowercase ASCII tokens; the builder panics rather than returning a Result because it is intended for statically valid configuration.","triggerScenarios":"Calling `warp::cors().allow_header(h)` where `h` cannot convert to `HeaderName` — e.g. `allow_header(\"Content Type\")` (space), `allow_header(\"\")`, names with non-ASCII or illegal characters, or strings that fail `HeaderName` validation.","commonSituations":"Header names copied from HTTP logs with whitespace or values attached (\"Authorization: Bearer\"), config files listing headers with typos, passing header values instead of names, mixed-case is fine but special characters are not.","solutions":["Pre-validate with `http::header::HeaderName::try_from(s)` (or `.parse::<HeaderName>()`) before calling `allow_header`.","Pass `http::header::constants` directly (e.g. `http::header::AUTHORIZATION`, `http::header::CONTENT_TYPE`) to avoid conversion failures.","Clean the configured values: use the bare header name only, trimmed, ASCII, no colons or values.","Fail at config-load time with a descriptive error if any header name is invalid."],"exampleFix":"// before\nlet cors = warp::cors().allow_header(cfg.header); // \"Content Type\" -> panic\n\n// after\nlet name: http::HeaderName = cfg\n    .header\n    .parse()\n    .map_err(|e| anyhow!(\"invalid CORS header name '{}': {}\", cfg.header, e))?;\nlet cors = warp::cors().allow_header(name);","handlingStrategy":"validation","validationCode":"fn is_valid_header(s: &str) -> bool {\n    http::header::HeaderName::try_from(s).is_ok()\n}\n// before calling: assert!(is_valid_header(cfg.header));","typeGuard":"fn as_header(s: &str) -> Option<http::header::HeaderName> {\n    http::header::HeaderName::try_from(s).ok()\n}","tryCatchPattern":"// validate instead of catching the panic:\nlet name = http::header::HeaderName::try_from(input.as_str())\n    .map_err(|e| format!(\"invalid CORS header '{}': {}\", input, e))?;\nlet cors = warp::cors().allow_header(name);","preventionTips":["Pass `http::header::*` constants (AUTHORIZATION, CONTENT_TYPE) when possible.","Strip any `: value` portion copied from devtools; use bare names only.","Validate header names with parse/try_from before builder calls.","Watch for whitespace and non-ASCII characters in config files."],"tags":["cors","panic","invalid-argument","http-header","configuration"],"backgroundTag":"invalid-argument-value","analyzedSha":"ff34d7213ed55ec342304aa7ff6ac4b351da9e66","analyzedAt":"2026-09-09T16:57:46.316Z","contentChangedAt":"2026-09-09T16:57:46.316Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}