{"id":"b8b741e0121e3d83","repo":"actix/actix-web","slug":"invalid-header-name","errorCode":null,"errorMessage":"Invalid header name","messagePattern":"Invalid header name","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"actix-web/src/middleware/default_headers.rs","lineNumber":91,"sourceCode":"        self\n    }\n\n    #[doc(hidden)]\n    #[deprecated(\n        since = \"4.0.0\",\n        note = \"Prefer `.add((key, value))`. Will be removed in v5.\"\n    )]\n    pub fn header<K, V>(self, key: K, value: V) -> Self\n    where\n        HeaderName: TryFrom<K>,\n        <HeaderName as TryFrom<K>>::Error: Into<HttpError>,\n        HeaderValue: TryFrom<V>,\n        <HeaderValue as TryFrom<V>>::Error: Into<HttpError>,\n    {\n        self.add((\n            HeaderName::try_from(key)\n                .map_err(Into::into)\n                .expect(\"Invalid header name\"),\n            HeaderValue::try_from(value)\n                .map_err(Into::into)\n                .expect(\"Invalid header value\"),\n        ))\n    }\n\n    /// Adds a default *Content-Type* header if response does not contain one.\n    ///\n    /// Default is `application/octet-stream`.\n    pub fn add_content_type(self) -> Self {\n        #[allow(clippy::declare_interior_mutable_const)]\n        const HV_MIME: HeaderValue = HeaderValue::from_static(\"application/octet-stream\");\n        self.add((CONTENT_TYPE, HV_MIME))\n    }\n}\n\nimpl<S, B> Transform<S, ServiceRequest> for DefaultHeaders\nwhere","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/actix/actix-web/blob/937960ca67f20e14ffe2a075bf6d4593502be12c/actix-web/src/middleware/default_headers.rs#L73-L109","documentation":"The deprecated `DefaultHeaders::header()` helper at actix-web/src/middleware/default_headers.rs:88-95 converts the key with `HeaderName::try_from` and `.expect(\"Invalid header name\")` on failure. Any byte sequence that is not a valid HTTP header token (e.g. contains `:`, spaces, or non-token characters) panics.","triggerScenarios":"Calling `.header(\":\", \"v\")`, `.header(\"Bad Name\", \"v\")`, or any key failing RFC 7230 token rules via the deprecated method.","commonSituations":"Using the old `header()` API with dynamically generated or user-supplied header names.","solutions":["Switch to the current `.add((name, value))` API and validate the name yourself, returning a `Result` instead of panicking.","Sanitize/validate header names against the token grammar before calling.","Use a known-valid static name constant from `actix_web::http::header`."],"exampleFix":"// before\nmw.header(\":\", \"v\");\n\n// after\n// prefer the non-deprecated, result-friendly API:\nfn try_add(mw: DefaultHeaders, k: &str, v: &str) -> Result<DefaultHeaders, actix_web::Error> {\n    let name = HeaderName::try_from(k)?;\n    let val = HeaderValue::try_from(v)?;\n    Ok(mw.add((name, val)))\n}","handlingStrategy":"validation","validationCode":"// Validate header names with TryFrom and handle the error instead of panicking.\nuse actix_web::http::header::HeaderName;\nfn valid_name(k: &str) -> bool {\n    HeaderName::try_from(k).is_ok()\n}\n// assert!(!valid_name(\":\"));\n// assert!(valid_name(\"x-test\"));","typeGuard":"fn is_valid_header_name(k: &str) -> bool {\n    HeaderName::try_from(k).is_ok()\n}","tryCatchPattern":null,"preventionTips":["Migrate off the deprecated header() method to .add((name, value)).","Validate user-supplied header names against the RFC 7230 token grammar."],"tags":["rust","actix","actix-web","middleware","runtime","panic","deprecated","headers"],"analyzedSha":"937960ca67f20e14ffe2a075bf6d4593502be12c","analyzedAt":"2026-08-06T01:15:46.978Z","schemaVersion":2}