A value sent in an HTTP header (credentials, User-Agent): non-blank, no C0
control character other than tab (so no CR/LF header injection), no DEL, and
nothing above U+00FF, which Node's HTTP layer cannot send. Tab and Latin-1
(e.g. "ü") are allowed — exactly what Node sends (as single ISO-8859-1 bytes).
Checked by char code so the source stays free of control bytes.
A value sent in an HTTP header (credentials, User-Agent): non-blank, no C0 control character other than tab (so no CR/LF header injection), no DEL, and nothing above U+00FF, which Node's HTTP layer cannot send. Tab and Latin-1 (e.g. "ü") are allowed — exactly what Node sends (as single ISO-8859-1 bytes). Checked by char code so the source stays free of control bytes.