property

https.ServerOptions.httpValidation

httpValidation?: 'strict' | 'relaxed' | 'insecure'

Controls HTTP header value validation strictness for incoming requests. Accepted values are:

  • 'strict': Strictest validation; rejects any non-ASCII or control characters in header values.
  • 'relaxed': Allows a limited set of non-ASCII characters in header values, aligning with the Fetch specification.
  • 'insecure': Disables all header value validation (equivalent to insecureHTTPParser: true).

Cannot be used together with insecureHTTPParser. Default: 'strict'.