A value that goes into an HTTP header (the User-Agent): non-blank, no C0 control
or DEL (tab is allowed, as in HTTP), nothing above U+00FF. Node's HTTP layer
refuses those with an opaque "Invalid character in header content" TypeError at
request time, and an injected transport would send a CR/LF value as is.
Checked by char code so the source stays free of control bytes.
A value that goes into an HTTP header (the User-Agent): non-blank, no C0 control or DEL (tab is allowed, as in HTTP), nothing above U+00FF. Node's HTTP layer refuses those with an opaque "Invalid character in header content" TypeError at request time, and an injected transport would send a CR/LF value as is. Checked by char code so the source stays free of control bytes.