{"record":{"id":"d7753d4e5e134f2e","repo":"FlowiseAI/Flowise","slug":"invalid-header-key-this-header-name-is-not-a","errorCode":null,"errorMessage":"Invalid header \"${key}\": this header name is not allowed","messagePattern":"Invalid header \"(.+?)\": this header name is not allowed","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/headerValidation.ts","lineNumber":62,"sourceCode":"    const entries = Object.entries(headers)\n    if (entries.length > MAX_HEADERS) {\n        throw new Error(`Invalid headers: too many entries (max ${MAX_HEADERS})`)\n    }\n\n    for (const [key, value] of entries) {\n        if (typeof key !== 'string' || key.length === 0) {\n            throw new Error('Invalid header: key must be a non-empty string')\n        }\n        if (key.length > MAX_KEY_LENGTH) {\n            throw new Error(`Invalid header \"${key}\": key exceeds ${MAX_KEY_LENGTH} chars`)\n        }\n        if (!RFC7230_TOKEN.test(key)) {\n            throw new Error(`Invalid header \"${key}\": key contains illegal characters`)\n        }\n\n        const lower = key.toLowerCase()\n        if (DENIED_HEADER_NAMES.has(lower) || DENIED_HEADER_PREFIXES.some((p) => lower.startsWith(p))) {\n            throw new Error(`Invalid header \"${key}\": this header name is not allowed`)\n        }\n\n        if (typeof value !== 'string') {\n            throw new Error(`Invalid header \"${key}\": value must be a string`)\n        }\n        if (value.length > MAX_VALUE_LENGTH) {\n            throw new Error(`Invalid header \"${key}\": value exceeds ${MAX_VALUE_LENGTH} chars`)\n        }\n        for (let i = 0; i < value.length; i++) {\n            const code = value.charCodeAt(i)\n            if (code === 0x0d || code === 0x0a || (code < 0x20 && code !== 0x09)) {\n                throw new Error(`Invalid header \"${key}\": value contains illegal control characters`)\n            }\n        }\n    }\n}\n\n/**","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/headerValidation.ts#L44-L80","documentation":"Deny-list enforcement. DENIED_HEADER_NAMES = {host, content-length, transfer-encoding, connection, upgrade, cookie, set-cookie, proxy-authorization, proxy-connection}. DENIED_HEADER_PREFIXES = ['proxy-', 'x-forwarded-', 'sec-']. These are hop-by-hop (RFC 7230 §6.1), routing/injection, or cookie headers that the system reserves or forbids for outbound requests. Comparison is case-insensitive on the lowercased key.","triggerScenarios":"Caller includes any exact denied name (e.g. 'Host', 'Connection', 'Cookie') or any name whose lowercase form starts with 'proxy-', 'x-forwarded-', or 'sec-' (e.g. 'X-Forwarded-For', 'Sec-Fetch-Mode', 'Proxy-Connection').","commonSituations":"Forwarding the full inbound header bag downstream without stripping hop-by-hop/routing headers; trying to set Host manually; passing auth via Cookie or Proxy-Authorization instead of Authorization; security/browser headers (Sec-*) carried over from an inbound browser request.","solutions":["Remove the denied header from the set; let the HTTP client set Host, Connection, Content-Length, Transfer-Encoding itself.","For authentication use 'Authorization' (not denied) instead of Cookie / Proxy-Authorization.","Strip 'X-Forwarded-*', 'Sec-*', and 'Proxy-*' from inbound headers before forwarding."],"exampleFix":"// before\nvalidateCustomHeaders({\n    Host: 'example.com',\n    'X-Forwarded-For': '1.2.3.4',\n    Cookie: 'session=...'\n}) // all three throw\n\n// after\nvalidateCustomHeaders({\n    Authorization: 'Bearer ...',\n    'X-Trace-Id': 'abc'\n})","handlingStrategy":"validation","validationCode":"// Strip denied hop-by-hop / routing / cookie headers before validation\nconst DENIED = new Set(['host','content-length','transfer-encoding','connection','upgrade','cookie','set-cookie','proxy-authorization','proxy-connection'])\nconst DENIED_PREFIX = ['proxy-','x-forwarded-','sec-']\nfunction stripDenied(headers) {\n    const out = {}\n    for (const [k, v] of Object.entries(headers)) {\n        const lower = k.toLowerCase()\n        if (DENIED.has(lower) || DENIED_PREFIX.some((p) => lower.startsWith(p))) continue\n        out[k] = v\n    }\n    return out\n}","typeGuard":"function hasNoDeniedHeaders(headers) {\n    const denied = new Set(['host','content-length','transfer-encoding','connection','upgrade','cookie','set-cookie','proxy-authorization','proxy-connection'])\n    return Object.keys(headers).every((k) => {\n        const lower = k.toLowerCase()\n        return !denied.has(lower) && !['proxy-','x-forwarded-','sec-'].some((p) => lower.startsWith(p))\n    })\n}","tryCatchPattern":"try {\n    validateCustomHeaders(headers)\n} catch (e) {\n    if (/header name is not allowed/i.test(e.message)) headers = stripDenied(headers)\n    else throw e\n    validateCustomHeaders(headers)\n}","preventionTips":["Let the HTTP client set Host, Connection, Content-Length, Transfer-Encoding itself.","Use 'Authorization' for credentials, never Cookie or Proxy-Authorization.","Strip 'X-Forwarded-*', 'Sec-*', and 'Proxy-*' from inbound headers before forwarding downstream."],"tags":["headers","validation","security","hop-by-hop","http"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}