A value for an HTTP header (the User-Agent): not blank, and only printable
Latin-1 plus tab. Every other C0 control (CR/LF included), DEL and anything
above U+00FF is rejected, wherever it sits: the whole value is scanned, not a
trimmed copy, so a CR/LF at either end counts like one inside. Node's HTTP layer
could not send these either. Checked by char code so the source stays free of
control bytes.
A value for an HTTP header (the User-Agent): not blank, and only printable Latin-1 plus tab. Every other C0 control (CR/LF included), DEL and anything above U+00FF is rejected, wherever it sits: the whole value is scanned, not a trimmed copy, so a CR/LF at either end counts like one inside. Node's HTTP layer could not send these either. Checked by char code so the source stays free of control bytes.