How to fix TypeError: Invalid header value provided (header contains invalid characters) in Node.js

const http = require('http');

// Unsafe - user input directly in header
const req = http.request({
  hostname: 'example.com',
  headers: {
    'X-Custom': userInput  // DANGEROUS!
  }
});

// Safe - validate first
function isValidHeaderValue(value) {
  // Allow only printable ASCII + tabs (0x20-0x7E and 0x09)
  return /^[	\x20-\x7E]*$/.test(value);
}

const sanitized = String(userInput).trim();
if (!isValidHeaderValue(sanitized)) {
  throw new Error('Invalid header value');
}

const req = http.request({
  hostname: 'example.com',
  headers: {
    'X-Custom': sanitized  // Safe
  }
});

const http = require('http');
const express = require('express');
const app = express();

app.get('/api/proxy', (req, res) => {
  // Unsafe - user input directly in header
  // const userAgent = req.query.ua;  // Could be: "test\r\nX-Injected: value"

  // Safe - remove newlines and control characters
  const userAgent = String(req.query.ua || '')
    .replace(/[\r\n]/g, '')  // Remove newlines
    .replace(/[^\x20-\x7E\t]/g, '');  // Keep only valid chars

  const options = {
    hostname: 'external-api.com',
    headers: {
      'User-Agent': userAgent || 'MyApp/1.0'  // Safe default
    }
  };

  const request = http.request(options, (response) => {
    res.writeHead(response.statusCode, response.headers);
    response.pipe(res);
  });

  request.on('error', (err) => {
    res.status(500).json({ error: err.message });
  });

  request.end();
});

const http = require('http');
const querystring = require('querystring');

// Example: passing JSON or complex data in headers
const data = {
  userId: 123,
  action: 'view',
  timestamp: Date.now()
};

// Unsafe - raw JSON has characters that violate headers
// const header = JSON.stringify(data);  // Contains {, }, :, ", etc.

// Safe - encode as URL parameter
const encoded = querystring.stringify(data);
// Result: "userId=123&action=view&timestamp=1234567890"

const options = {
  hostname: 'api.example.com',
  path: '/data',
  headers: {
    'X-Data': encoded  // Safe - only alphanumeric, =, &
  }
};

const req = http.request(options, (res) => {
  console.log('Status:', res.statusCode);
});

req.end();

// On the receiving end, decode:
const received = querystring.parse(req.headers['x-data']);
console.log(received.userId);  // "123"

const http = require('http');

// Complex data that might contain invalid characters
const binaryData = Buffer.from('\x00\x01\x02\x03', 'binary');

// Unsafe - setting raw binary data
// headers: { 'X-Data': binaryData }  // Will fail

// Safe - encode to base64
const encoded = binaryData.toString('base64');

const options = {
  hostname: 'api.example.com',
  headers: {
    'X-Data': encoded,  // "AAEQAQ=="
    'X-Data-Encoding': 'base64'
  }
};

const req = http.request(options, (res) => {
  console.log('Response received');
});

req.on('error', (err) => {
  console.error('Error:', err.message);
});

req.end();

// On the receiving end:
app.get('/api/data', (req, res) => {
  if (req.headers['x-data-encoding'] === 'base64') {
    const decoded = Buffer.from(req.headers['x-data'], 'base64');
    console.log(decoded);  // Original binary data
  }
  res.send('OK');
});

const http = require('http');

function setHeaderSafely(res, name, value, defaultValue = '') {
  try {
    // Validate before setting
    const sanitized = String(value).trim();

    // Check for newlines
    if (sanitized.includes('\n') || sanitized.includes('\r')) {
      console.warn(`Header '${name}' contains newlines, using default`);
      res.setHeader(name, defaultValue);
      return;
    }

    // Try to set
    res.setHeader(name, sanitized);
  } catch (err) {
    console.error(`Failed to set header '${name}': ${err.message}`);
    // Use safe default instead of crashing
    if (defaultValue) {
      res.setHeader(name, defaultValue);
    }
  }
}

// Usage in Express
const express = require('express');
const app = express();

app.get('/api/data', (req, res) => {
  setHeaderSafely(res, 'X-User-ID', req.query.userId, 'unknown');
  setHeaderSafely(res, 'X-Request-ID', req.headers['x-request-id']);

  res.json({ status: 'ok' });
});

// Using express-validator for header validation
const express = require('express');
const { validationResult, header } = require('express-validator');

const app = express();

// Validate custom headers on incoming requests
app.get('/api/data',
  header('X-Custom-Header').trim().escape().optional(),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }

    res.json({ received: req.headers['x-custom-header'] });
  }
);

// Using a sanitization utility
function createSafeHeader(name, value) {
  // Remove control characters and newlines
  const sanitized = String(value)
    .replace(/[\r\n]/g, '')  // Remove newlines
    .replace(/[^\x20-\x7E\t]/g, '')  // Keep only valid ASCII
    .trim();

  if (!sanitized) {
    throw new Error(`Header '${name}' became empty after sanitization`);
  }

  if (sanitized.length > 8000) {
    throw new Error(`Header '${name}' exceeds maximum length`);
  }

  return { name, value: sanitized };
}

module.exports = { createSafeHeader };