valyala/fasthttp · error

fasthttp: extra whitespace in request line

Error message

fasthttp: extra whitespace in request line

What it means

When parsing a request line, fasthttp splits it into method, requestURI, and protocol by whitespace. If it encounters more whitespace than expected between the tokens (e.g. multiple spaces), ErrExtraWhitespaceInRequestLine is returned. Strict parsing here prevents request smuggling via odd spacing.

Source

Thrown at header.go:476

// 3. request modifiers (e.g., controls and conditionals in Section 5 of [RFC7231]),
// 4. authentication (e.g., see [RFC7235] and [RFC6265]),
// 5. response control data (e.g., see Section 7.1 of [RFC7231]),
// 6. determining how to process the payload (e.g., Content-Encoding, Content-Type, Content-Range, and Trailer)
//
// Return ErrBadTrailer if contain any forbidden trailers.
func (h *header) AddTrailer(trailer string) error {
	return h.AddTrailerBytes(s2b(trailer))
}

var (
	ErrBadTrailer                    = errors.New("fasthttp: contain forbidden trailer")
	ErrReadingResponseHeaders        = errors.New("fasthttp: error when reading response headers")
	ErrReadingResponseTrailer        = errors.New("fasthttp: error when reading response trailer")
	ErrResponseFirstLineMissingSpace = errors.New("fasthttp: cannot find whitespace in the first line of response")
	ErrUnexpectedStatusCodeChar      = errors.New("fasthttp: unexpected char at the end of status code")
	ErrMissingRequestMethod          = errors.New("fasthttp: cannot find http request method")
	ErrUnsupportedRequestMethod      = errors.New("fasthttp: unsupported http request method")
	ErrExtraWhitespaceInRequestLine  = errors.New("fasthttp: extra whitespace in request line")
	ErrEmptyRequestURI               = errors.New("fasthttp: requesturi cannot be empty")
	ErrDuplicateContentLength        = errors.New("fasthttp: duplicate content-length header")
	ErrUnsupportedTransferEncoding   = errors.New("fasthttp: unsupported transfer-encoding")
	ErrNonNumericChars               = errors.New("fasthttp: non-numeric chars found")
	ErrNeedMore                      = errors.New("fasthttp: need more data: cannot find trailing lf")
	ErrSmallReadBuffer               = errors.New("fasthttp: small read buffer. increase readbuffersize")
)

// AddTrailerBytes add Trailer header value for chunked response
// to indicate which headers will be sent after the body.
//
// Use Set to set the trailer header later.
//
// Trailers are only supported with chunked transfer.
// Trailers allow the sender to include additional headers at the end of chunked messages.
//
// The following trailers are forbidden:
// 1. necessary for message framing (e.g., Transfer-Encoding and Content-Length),

View on GitHub (pinned to c96f600972)

Solutions

1. Fix the upstream client to emit single-space-separated request lines per RFC 7230.
2. Identify the offending client via access logs or by capturing raw bytes (fasthttputil.NewInetListener + manual read).
3. If a proxy/load balancer rewrites request lines, disable that rewriting.
4. On your server, treat this as client error and return 400; no server-side code change is needed since fasthttp rejects it safely.

Example fix

// before
raw := "GET  /index HTTP/1.1\r\nHost: x\r\n\r\n" // double space
// after
raw := "GET /index HTTP/1.1\r\nHost: x\r\n\r\n"

// For raw request construction, assert single spaces:
// regexp.MustCompile(`^[A-Z]+ [^ ]+ HTTP/1\.[01]$`).MatchString(requestLine)

func isRequestLineWellFormed(line []byte) bool {
    parts := bytes.Fields(line)
    return len(parts) == 3 && len(bytes.Split(line, []byte(" "))) == 3
}

if err := req.Read(r); err == fasthttp.ErrExtraWhitespaceInRequestLine {
    // log offending client, respond 400 / drop connection
    return fmt.Errorf("malformed request line: %w", err)
}

When it happens

Trigger: Reading (Request.Read / server-side request parse) a request line like 'GET /path HTTP/1.1' (double space) or with stray tabs between method/URI/protocol; crafted requests from clients attempting parser confusion.

Common situations: A nonconformant HTTP client or hand-written client emitting padded request lines; load balancers or security scanners sending malformed probes; fuzz tests against your fasthttp server.

Related errors

• fasthttp: duplicate content-length header
• fasthttp: contain forbidden trailer
• fasthttp: error when reading response headers
• fasthttp: error when reading response trailer
• fasthttp: cannot find whitespace in the first line of respon

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/f08f072c2f52973e. Report an issue: GitHub.