Obsolete Line Folding

Obsolete line folding is a deprecated syntax feature originating from older versions of the HTTP/1.1 protocol.

What Is Line Folding ?

HTTP header fields are normally written on a single line. However, in older HTTP/1.0 and early HTTP/1.1 specifications, it was possible to spread a long header value across multiple lines. This was called line folding.

Line folding worked as follows: after placing a CRLF (\r\n) at the end of a line, if the next line began with a space (SP) or tab (HTAB) character, the two lines would be merged into a single header value.

The example above would be interpreted as:

Why Was It Removed?

1. Security vulnerabilities — It opened the door to HTTP Response Splitting and header injection attacks. When different parsers interpreted line folding differently, inconsistent behavior emerged across systems.

2. Ambiguity — There were inconsistencies between middleware, proxies, and the application layer regarding how headers should be merged.

3. Redundancy — Since modern HTTP has no practical limit on header value length, there is no longer any need to split long values across lines.

4. Parser complexity — Requiring every HTTP library to support this edge case added unnecessary code complexity.

While modern browsers silently normalize this format, Netty’s HttpClientCodec strictly follows modern HTTP specifications and rejects such headers during decoding.As a result, the proxy failed while decoding the upstream response headers and our customer could not access the website.

Solution

A parameter (http.proxy.allow.obsolete.header.line.unfolding) should be added in http_proxy.properties file as true. Default value was false.

·            Detects obs-folded HTTP response headers (CRLF + space/tab)

·            Normalizes them into a single-line header value

This approach does not disable header validation globally and only addresses the specific legacy formatting issue.Additionally, If the proxy detects obs-folded headers while the this feature is disabled, the logs will include the following message:

Important:

·            Please enable this parameter only when strictly necessary.

·            For all other customers and environments, this feature should remain disabled.

Why this feature should not be enabled by default

·            Obs-fold is obsolete and explicitly discouraged by modern HTTP specifications

·            Accepting it globally would relax strict HTTP validation

·            Modern servers should always send headers in a single-line format

·            This feature exists purely as a compatibility workaround for legacy or misbehaving upstream components