Search code examples
httpfiddler

Fiddler adds space after colon


I am making a request like so in Fiddler2

User-Agent: Fiddler
Host: asdf.example.com
Content-Type: application/x-www-form-urlencoded 
Content-Length: 0
Key=asdf:qwer

When I click Execute, Fiddler edits the last line to read:

Key=asdf: qwer

Note the additional space.

Why is this happening and could it cause problems with my request?


Solution

  • RFC 2616, 4.2 Message Headers:

    Each header field consists of a name followed by a colon (":") and the field value. Field names are case-insensitive. The field value MAY be preceded by any amount of LWS, though a single SP is preferred.

    [...]

    The field-content does not include any leading or trailing LWS: linear white space occurring before the first non-whitespace character of the field-value or after the last non-whitespace character of the field-value. Such leading or trailing LWS MAY be removed without changing the semantics of the field value. Any LWS that occurs between field-content MAY be replaced with a single SP before interpreting the field value or forwarding the message downstream.

    In other words: leading whitespace is to be ignored for the field value, and a space is even preferred. When you do want to send a space, you'll have to quote the string: Some-Header: " foo".

    So it's nice of Fiddler to display (and probably send) it like that, though a custom HTTP server that doesn't expect a space there is faulty and should be repaired.

    As for your comment regarding the "invalid header name" error the server returns: an HTTP header is defined as such:

    message-header = field-name ":" [ field-value ]
    
    field-name     = token
    field-value    = [...]
    

    As you can see, field-name can only exist of token, which does not include = (as that is a separator).

    So the header name Key=asdf you use is invalid and the server throws a 400 Bad Request because of malformed syntax. The more specific Invalid header name you claim to get, sounds like you're running your site in IIS. Change the = to - for example, and you'll see it'll work.