Why do HTTP servers forbid underscores in HTTP header names

apache http nginx rfc
white picture white · Apr 4, 2014 · Viewed 30.5k times · Source

I had a problem with a custom HTTP SESSION_ID header not being transfered by nginx proxy.

I was told that underscores are prohibited according to the HTTP RFC.

Searching, I found that most servers like Apache or nginx define them as illegal in RFC2616 section 4.2, which says:

follow the same generic format as that given in Section 3.1 of RFC 822 [9]

RFC822 says:

The field-name must be composed of printable ASCII characters (i.e., characters that have values between 33. and 126., decimal, except colon)

Underscore is decimal character 95 in the ASCII table in the 33-126 range.

What am I missing?

Answer

Alexey Ten picture Alexey Ten · Apr 4, 2014

They are not forbidden, it's CGI legacy. See "Missing (disappearing) HTTP Headers".

If you do not explicitly set underscores_in_headers on;, nginx will silently drop HTTP headers with underscores (which are perfectly valid according to the HTTP standard). This is done in order to prevent ambiguities when mapping headers to CGI variables, as both dashes and underscores are mapped to underscores during that process.

Related questions

Https to http redirect using htaccess

I'm trying to redirect https://www.example.com to http://www.example.com. I tried the following code in the .htaccess file RewriteEngine On RewriteCond %{HTTP_HOST} ^example\.com$ [NC] RewriteRule ^(.*)$ http://www.example.com/$1 [R=301,L] This code successfully …

Read More
Redirect HTTP to HTTPS on default virtual host without ServerName

On my apache server I'd like to be able to redirect all incoming http requests to the equivalent https request. The catch is that I'd like to be able to do this for my default virtual host without specifying the …

Read More
What is the difference between CloseableHttpClient and HttpClient in Apache HttpClient API?

I'm studying an application developed by our company. It uses the Apache HttpClient library. In the source code it uses the HttpClient class to create instances to connect to a server. I want to learn about Apache HttpClient and I've …

Read More