Re: spaces in HTTP headers

["Roy T. Fielding" <fi...@avron.ICS.UCI.EDU>]

>>  http://aqui.stllab.ibm.com
> 
> They have a system which requests URLs from other servers, their
> system adds an extra header to the HTTP headers, e.g. when talking
> to xxx.lanl.gov it added
> 
>  FOO: xxx
> 
> note the leading space. Apache created env var "HTTP_ FOO" = "xxx",
> and the shell rejected it when trying to do a "exec cmd"
> 
> My boss says that Apache should be fixed to not send the " " in the
> env var (that'd mean checking incoming HTTP headers against the spec).
> I say, slap the wrists of the people at ibm and be done with it.
> 
> I've mailed the resource owners to tell them about their spec
> violation.

If it starts with a space, the it isn't a new header (no matter what
it looks like).  Instead, it is a continuation of the header field
above it, and must be treated as such in Apache.

.......Roy