A value that goes into an HTTP header (the User-Agent, a default header):
non-blank, no C0 control or DEL (tab is allowed, as in HTTP), nothing above
U+00FF. A blank User-Agent is sent empty, which WAFs block; Node's HTTP layer
refuses the rest with an opaque "Invalid character in header content" TypeError
at request time, and an injected transport would send a CR/LF value as is.
Checked by char code so the source stays free of control bytes.
A value that goes into an HTTP header (the User-Agent, a default header): non-blank, no C0 control or DEL (tab is allowed, as in HTTP), nothing above U+00FF. A blank User-Agent is sent empty, which WAFs block; Node's HTTP layer refuses the rest with an opaque "Invalid character in header content" TypeError at request time, and an injected transport would send a CR/LF value as is. Checked by char code so the source stays free of control bytes.