HTTP::Headers not working if header has “:” in it comes as Illegal field name . [rt.cpan.org #91835]

[Olaf Alders]

Migrated from rt.cpan.org#91835 (status was 'open')

Requestors:

• [e-mail]

Attachments:

• mg_info.txt

From [e-mail] on 2014-01-03 16:55:45:

Subject : HTTP::Headers not working if header has �:� in it comes as Illegal field name .

Sample code that will not work
       my $list_request = HTTP::Request->new( POST => $list_request_api );
       $list_request->content_type('application/json');
       $list_request->header( "Authorization:Bearer" => $final->{access_token},
                                            "Accept"               => "application/json" );
       $list_request->content($security_list);
       eval { $list_results = $List_agent->request($list_request) };
       $@ and warn "Exception when requesting data : $@\n";

Module code that causes this .
Headers.pm

       Carp::croak("Illegal field name '$field'")
        if rindex($field, ':') > 1 || !length($field);

Thanks
Avnit Bambah

From [e-mail] on 2014-01-07 18:10:05:

Well, it is an illegal field name. Since ":" is used to separate the field name
from the value and there is not escape mechanism to actually have an literal
":" in the name itself. What's you context for wanting this?

From [e-mail] on 2014-01-07 18:34:50:

My header has ":" and I want to use it like this to get authorization . 

  $list_request->header( "Authorization:Bearer" => $final->{access_token},
                           "Accept"               => "application/json" );
    $list_request->content($security_list);

I totally agree with your logic . Is there a way I can pass it ?

Thanks 
Avnit 

-----Original Message-----
From: Gisle_Aas via RT [mailto:[e-mail]] 
Sent: Tuesday, January 07, 2014 12:10 PM
To: Bambah, Avnit
Subject: [rt.cpan.org #91835] HTTP::Headers not working if header has �:� in it comes as Illegal field name .

<URL: https://rt.cpan.org/Ticket/Display.html?id=91835 >

Well, it is an illegal field name. Since ":" is used to separate the field name
from the value and there is not escape mechanism to actually have an literal
":" in the name itself. What's you context for wanting this?


 
 
--------
If you are not an intended recipient of this e-mail, you are not authorized to duplicate, copy, retransmit or redistribute it by any means. Please delete it and any attachments immediately and notify the sender that you have received it in error. Unless specifically indicated, this e-mail is not an offer to buy or sell or a solicitation to buy or sell any securities, investment products or other financial product or service, an official confirmation of any transaction, or an official statement of Neuberger Berman. Any views or opinions presented are solely those of the author and do not necessarily represent those of Neuberger Berman. This e-mail is subject to terms available at the following link: www.nb.com/disclaimer/usa.html. By messaging with Neuberger Berman you consent to the foregoing.

From [e-mail] on 2014-01-07 19:36:18:

On Tue Jan 07 13:34:50 2014, [e-mail] wrote:
> My header has ":" and I want to use it like this to get authorization.
>
> $list_request->header( "Authorization:Bearer" => $final->{access_token},

I think what you actually want is:

$list_request->header( "Authorization" => "Bearer $final->{access_token}")

I don't know what the "Bearer" scheme is, but that's how you do Basic auth, so
I guess it follows the same pattern.

See http://tools.ietf.org/html/rfc2617#section-2

From [e-mail] on 2014-01-07 19:38:29:

On Tue, Jan 07, 2014 at 01:34:50PM -0500, Bambah, Avnit via RT wrote:
> My header has ":" and I want to use it like this to get authorization . 
>   $list_request->header( "Authorization:Bearer" => $final->{access_token},
> I totally agree with your logic . Is there a way I can pass it ?

I'd go back to whoever defined that 'Authorization:Bearer' header and thump
them on the head with a paper copy of RFC 2616. :p

[Theo van Hoesel]

this issue should be closed. Like @karenetheridge already said four years ago:

I'd go back to whoever defined that 'Authorization:Bearer' header and thump
them on the head with a paper copy of RFC 2616.

Guess someone indeed mistakenly read it as "Authorization:Bearer"