conductor-oss/conductor · error · IllegalArgumentException

API spec headers must not contain CR or LF characters

Error message

API spec headers must not contain CR or LF characters

What it means

Error "API spec headers must not contain CR or LF characters" thrown in conductor-oss/conductor.

Source

Thrown at agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/ListApiToolsTask.java:284

            }
            currentUrl = target;
        }
        throw new IllegalArgumentException("API spec exceeded the redirect limit");
    }

    private void addHeaders(HttpRequest.Builder builder, Map<String, String> headers) {
        if (headers == null) {
            return;
        }
        headers.forEach(
                (name, value) -> {
                    if (name == null
                            || value == null
                            || name.indexOf('\r') >= 0
                            || name.indexOf('\n') >= 0
                            || value.indexOf('\r') >= 0
                            || value.indexOf('\n') >= 0) {
                        throw new IllegalArgumentException(
                                "API spec headers must not contain CR or LF characters");
                    }
                    builder.header(name, value);
                });
    }

    private boolean hasSensitiveHeaders(Map<String, String> headers) {
        if (headers == null) {
            return false;
        }
        return headers.keySet().stream()
                .anyMatch(
                        name ->
                                "authorization".equalsIgnoreCase(name)
                                        || "cookie".equalsIgnoreCase(name)
                                        || "proxy-authorization".equalsIgnoreCase(name));
    }

View on GitHub (pinned to cf7c3e4a8a)

Solutions

1. Remove CR/LF characters from the configured API spec header values; they are rejected to prevent header injection.

When it happens

Trigger: Thrown at agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/ListApiToolsTask.java:284 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of conductor-oss/conductor@cf7c3e4a8a (2026-08-14). Data as JSON: /api/errors/4c50420238f04d6e. Report an issue: GitHub.