restsharp/RestSharp · error · ArgumentException

Invalid character found in header {type}: {value}

Error message

Invalid character found in header {type}: {value}

What it means

Thrown by HeaderParameter when the header name or value contains a carriage return (\r) or line feed (\n) character. These characters enable HTTP header injection / response-splitting attacks, so the constructor rejects them unless encode=true is used to Base64-wrap the value per RFC 2047.

Source

Thrown at src/RestSharp/Parameters/HeaderParameter.cs:46

    public HeaderParameter(string name, string value, bool encode = false)
        : base(
            EnsureValidHeaderString(Ensure.NotEmptyString(name, nameof(name)), "name"),
            EnsureValidHeaderValue(name, value, encode),
            ParameterType.HttpHeader,
            false
        ) { }

    public new string Name  => base.Name!;
    public new string Value => (string)base.Value!;

    static string EnsureValidHeaderValue(string name, string value, bool encode) {
        CheckAndThrowsForInvalidHost(name, value);

        return EnsureValidHeaderString(GetValue(Ensure.NotNull(value, nameof(value)), encode), "value");
    }

    static string EnsureValidHeaderString(string value, string type)
        => !IsInvalidHeaderString(value) ? value : throw new ArgumentException($"Invalid character found in header {type}: {value}");

    static string GetValue(string value, bool encode) => encode ? GetBase64EncodedHeaderValue(value) : value;

    static string GetBase64EncodedHeaderValue(string value) => $"=?UTF-8?B?{Convert.ToBase64String(Encoding.UTF8.GetBytes(value))}?=";

    static bool IsInvalidHeaderString(string stringValue) {
        // ReSharper disable once ForCanBeConvertedToForeach
        for (var i = 0; i < stringValue.Length; i++) {
            switch (stringValue[i]) {
                case '\r':
                case '\n':
                    return true;
            }
        }

        return false;
    }

View on GitHub (pinned to 6a50821692)

Solutions

1. Strip or replace CR/LF characters from header values before adding them: value.Replace("\r", "").Replace("\n", "").
2. If newlines must be preserved, pass encode: true to HeaderParameter to Base64-encode per RFC 2047.
3. Sanitize all untrusted input used in headers at the trust boundary.

Example fix

// before
request.AddHeader("X-Comment", userInput); // userInput may contain newlines

// after
var safe = userInput.Replace("\r", " ").Replace("\n", " ");
request.AddHeader("X-Comment", safe);

if (value.IndexOfAny(new[] { '\r', '\n' }) >= 0) throw new ArgumentException("Header value contains CR/LF", nameof(value));

static bool IsSafeHeaderValue(string s) => s.IndexOfAny(new[] { '\r', '\n' }) < 0;

try { request.AddHeader(name, value); } catch (ArgumentException ex) when (ex.Message.Contains("Invalid character found in header")) { /* strip CR/LF or pass encode:true */ }

When it happens

Trigger: Constructing a HeaderParameter or calling request.AddHeader(name, value) where value (or name) contains embedded CR/LF characters, e.g. a multi-line user-agent string or untrusted input containing newlines.

Common situations: User-supplied input placed in a header without sanitization; multi-line descriptive strings; log-style values with line breaks; data read from files containing Windows-style line endings.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• The specified value is not a valid Host header string.
• Request resource doesn't contain a valid scheme for an empty
• Binary data format needs a byte array as value
• Cannot set request body using default parameters. Use Reques
• File not found

AI-assisted analysis of restsharp/RestSharp@6a50821692 (2026-08-13). Data as JSON: /api/errors/06ce9fd5957b20ac. Report an issue: GitHub.