A value sent in an HTTP header (credentials, User-Agent): non-blank, no C0
control character other than tab (so no CR/LF header injection), no DEL, and
nothing above U+00FF, which Node's HTTP layer cannot send. Tab and Latin-1
(e.g. "ü") are allowed — exactly what Node sends. Checked by char code so the
source stays free of control bytes.
A value sent in an HTTP header (credentials, User-Agent): non-blank, no C0 control character other than tab (so no CR/LF header injection), no DEL, and nothing above U+00FF, which Node's HTTP layer cannot send. Tab and Latin-1 (e.g. "ü") are allowed — exactly what Node sends. Checked by char code so the source stays free of control bytes.