Rule for an HTTP header value (the User-Agent): a non-blank string with no C0
control character other than tab (so no CR/LF header injection), no DEL and
nothing above U+00FF. That is what Node's HTTP layer accepts; it throws an opaque
"Invalid character in header content" for the rest. Checked by char code so the
source stays free of control bytes.
Rule for an HTTP header value (the User-Agent): a non-blank string with no C0 control character other than tab (so no CR/LF header injection), no DEL and nothing above U+00FF. That is what Node's HTTP layer accepts; it throws an opaque "Invalid character in header content" for the rest. Checked by char code so the source stays free of control bytes.