What causes "Invalid header value" in bevyengine/bevy?

Sanitize the value before inserting: strip or replace newlines and control bytes

Invalid header value

Error message

Invalid header value

What it means

The value-side counterpart of the header-name panic in `Headers::insert` (bevy_remote's HTTP transport for BRP): `insert` converts the value into `hyper`'s `HeaderValue` and panics when the conversion fails. String values must be visible ASCII; control characters and non-ASCII bytes are rejected.

Source

Thrown at crates/bevy_remote/src/http.rs:90

impl Headers {
    /// Create a new instance of `Headers`.
    pub fn new() -> Self {
        Self {
            headers: HashMap::default(),
        }
    }

    /// Insert a key value pair to the `Headers` instance.
    pub fn insert(
        mut self,
        name: impl TryInto<HeaderName>,
        value: impl TryInto<HeaderValue>,
    ) -> Self {
        let Ok(header_name) = name.try_into() else {
            panic!("Invalid header name")
        };
        let Ok(header_value) = value.try_into() else {
            panic!("Invalid header value")
        };
        self.headers.insert(header_name, header_value);
        self
    }
}

impl Default for Headers {
    fn default() -> Self {
        Self::new()
    }
}

/// Add this plugin to your [`App`] to allow remote connections over HTTP to inspect and modify entities.
/// It requires the [`RemotePlugin`](super::RemotePlugin).
///
/// This BRP transport cannot be used when targeting WASM.
///
/// The defaults are:

View on GitHub (pinned to 396ca72708)

Solutions

Sanitize the value before inserting: strip or replace newlines and control bytes
For binary values, encode them (Base64) or use `HeaderValue::from_bytes` on your side to validate first
Keep values to visible ASCII (0x20..0x7E) when building Headers for bevy_remote

Example fix

// before
let headers = Headers::new().insert("X-Custom", format!("a\nb"));

// after
let headers = Headers::new().insert("X-Custom", "a b");

Defensive patterns

Strategy: validation

Validate before calling

fn valid_header_value(value: &str) -> bool {
    hyper::header::HeaderValue::from_str(value).is_ok()
}

let sanitized = value.replace(['\n', '\r'], " ");
if valid_header_value(&sanitized) {
    headers = headers.insert(name, sanitized);
}

Prevention

Strip newlines/control bytes from any value built from user input
Base64-encode binary payloads instead of putting raw bytes in headers
Validate with HeaderValue::from_str before calling Headers::insert

When it happens

Trigger: Calling `headers.insert(name, value)` with a `&str`/`String` value containing control characters (newline, tab-adjacent control bytes, NUL) or non-ASCII characters, e.g. a value built from unescaped multi-line user input.

Common situations: Forwarding user text or JSON blobs into response headers without sanitizing; embedding `\n` in values copied from configuration files; non-UTF8-ASCII locale characters in values.

Related errors

AI-assisted analysis of bevyengine/bevy@396ca72708 (2026-08-20). Data as JSON: /api/errors/c2ca1f180b4194bd. Report an issue: GitHub.