How to fix TypeError: Invalid header value provided (header contains invalid characters) in Node.js

// Log all headers before setting them
const headerValue = getHeaderValue();
console.log('Setting header:', { name: 'X-Custom-Header', value: headerValue });
console.log('Value bytes:', Buffer.from(headerValue).toString('hex'));

try {
  res.setHeader('X-Custom-Header', headerValue);
} catch (err) {
  console.error('Failed to set header:', err.message);
  console.error('Problematic value:', JSON.stringify(headerValue));
}

const http = require('http');

// Use Node.js validation (Node 14+)
function validateHeaderValue(value) {
  try {
    http.validateHeaderValue('test-header', value);
    return true;
  } catch (err) {
    return false;
  }
}

// Or create custom sanitization
function sanitizeHeaderValue(value) {
  if (!value) return '';

  return String(value)
    .replace(/[\r\n\t]/g, '') // Remove control characters
    .replace(/[^\x20-\x7E]/g, '') // Keep only printable ASCII
    .trim();
}

// Use it
const userInput = req.query.customValue;
const safeValue = sanitizeHeaderValue(userInput);

if (validateHeaderValue(safeValue)) {
  res.setHeader('X-Custom-Header', safeValue);
}

function cleanHeaderValue(value) {
  if (typeof value !== 'string') {
    value = String(value);
  }

  // Remove all control characters (ASCII 0-31 and 127)
  return value.replace(/[\x00-\x1F\x7F]/g, '');
}

// Example usage
const description = req.body.description; // May contain newlines
res.setHeader('X-Description', cleanHeaderValue(description));

const metadata = { user: 'John', role: 'admin\nroot' };
const encoded = Buffer.from(JSON.stringify(metadata)).toString('base64');
res.setHeader('X-Metadata', encoded);

function setHeaderSafely(res, name, value) {
  // Only set header if value exists and is non-empty
  if (value !== undefined && value !== null && value !== '') {
    const stringValue = String(value);
    if (stringValue.trim()) {
      res.setHeader(name, stringValue.trim());
    }
  }
}

// Usage
setHeaderSafely(res, 'X-User-Id', userId);
setHeaderSafely(res, 'X-Session-Token', sessionToken);

const http = require('http');
const https = require('https');

// For http.request
const req = http.request({
  hostname: 'example.com',
  path: '/api',
  insecureHTTPParser: true // Allows non-compliant headers
}, (res) => {
  console.log('Response received:', res.statusCode);
});

// For axios
const axios = require('axios');
const axiosInstance = axios.create({
  httpAgent: new http.Agent({ insecureHTTPParser: true }),
  httpsAgent: new https.Agent({ insecureHTTPParser: true })
});

// For fetch with custom agent (Node 18+)
const agent = new https.Agent({ insecureHTTPParser: true });
const response = await fetch('https://example.com/api', { agent });

// Use RFC 2047 encoding for header values with non-ASCII
function encodeHeaderValue(value) {
  // Check if value contains non-ASCII
  if (/[^\x00-\x7F]/.test(value)) {
    // Use base64 encoding
    return '=?UTF-8?B?' + Buffer.from(value, 'utf-8').toString('base64') + '?=';
  }
  return value;
}

const filename = 'report_André_2025.pdf';
res.setHeader('Content-Disposition', `attachment; filename="${encodeHeaderValue(filename)}"`);

// Or use percent-encoding for URLs
const encodedFilename = encodeURIComponent(filename);
res.setHeader('Content-Disposition', `attachment; filename*=UTF-8''${encodedFilename}`);