[binaryfire]

Summary

HTTP/1 request and coroutine client parsing preserved trailing spaces and tabs in header values. The reactor's earlier header scans also handled optional whitespace inconsistently. RFC 9110 allows spaces and tabs around a field value and requires parsers to exclude them before evaluating it.

This can change values used by application code. For example, a bearer token with valid trailing header whitespace includes the suffix and fails authentication. Hypervel has a focused regression for this behavior.

Change

Trim trailing spaces and tabs after each complete HTTP/1 header value is assembled, before storing or interpreting it. Apply the same rule to request parsing, coroutine client responses, the C++ HTTP wrapper, and raw header lookups used by the static handler.

Recognize leading spaces and tabs in the reactor's Connection, multipart Content-Type, and Expect scans. This keeps valid whitespace from causing several different failures:

• large multipart uploads use preprocessing instead of being rejected with 413;
• static ranges return 206 instead of 416;
• Expect: 100-continue receives the interim response instead of waiting for the client timeout.

The keep-alive scan follows the same rule. Multipart boundaries are also trimmed when captured by the preprocessing path.

Internal whitespace remains unchanged.

Tests

Added regression coverage for direct and byte-fragmented request parsing, raw coroutine client responses, reactor header scans, Expect: 100-continue, static ranges, and multipart uploads large enough to use the preprocessing path. The regressions fail without their corresponding fixes and pass with this change.

Ran the focused request and client PHPTs and the related HTTP server core tests.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.34%. Comparing base (04efbe1) to head (1a76d30).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #6311   +/-   ##
=======================================
  Coverage   84.33%   84.34%           
=======================================
  Files         114      114           
  Lines       19154    19164   +10     
  Branches     3439     3442    +3     
=======================================
+ Hits        16153    16163   +10     
  Misses       3001     3001           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[binaryfire]

Follow-up: I expanded this to cover the same whitespace rule in Swoole's reactor-side header handling. It now also handles leading tabs in Connection, multipart Content-Type, and Expect, plus trailing whitespace in static Range headers. The title, body, and regressions have been updated.