A value that goes into an HTTP header (the User-Agent): non-blank, no C0 control
or DEL (tab is allowed, as in HTTP), nothing above U+00FF. A blank value would be
sent as an empty header; Node's HTTP layer refuses the others with an opaque
"Invalid character in header content" TypeError at request time, and an injected
transport would send a CR/LF value as is (header injection). Checked by char code
so the source stays free of control bytes.
A value that goes into an HTTP header (the User-Agent): non-blank, no C0 control or DEL (tab is allowed, as in HTTP), nothing above U+00FF. A blank value would be sent as an empty header; Node's HTTP layer refuses the others with an opaque "Invalid character in header content" TypeError at request time, and an injected transport would send a CR/LF value as is (header injection). Checked by char code so the source stays free of control bytes.