Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 08:30 UTC
caddyhttp: Document dropping underscore headers
Matthew Holt committed
Jun 18, 2026 at 09:34 UTC
30f0ddd91273adb81268de78d060bfaee6ce6bb6
1 file changed
+7
modules/caddyhttp/app.go
+7
@@ -46,6 +46,13 @@ func init() {
46
// only on the HTTPS port but which do not have any TLS connection policies
47
// defined by adding a good, default TLS connection policy.
48
//
49
+// Similar to how other popular web servers work, incoming request header fields
50
+// with underscores are ignored/dropped implicitly to mitigate security risks.
51
+// Specific headers to allow can be explicitly configured using
52
+// `expected_underscore_headers`.
53
+//
54
+// ### Placeholders
55
+//
56
// In HTTP routes, additional placeholders are available (replace any `*`):
57
//
58
// Placeholder | Description