Http-server: The header content contains invalid characters？

[pycodev]

I install the package and write a simple html page to try it.
Then I typed "http-server", the server was on.
But when I tried to visit the url, I got this error:

[Thu, 11 Feb 2016 06:18:12 GMT] "GET /" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.103 Safari/537.36" _http_outgoing.js:348 throw new TypeError('The header content contains invalid characters'); ^ TypeError: The header content contains invalid characters at ServerResponse.OutgoingMessage.setHeader (_http_outgoing.js:348:11) at ResponseStream.(anonymous function) [as setHeader] (D:\Programme\nodejs\node_global\node_modules\http-server\node_modules\union\lib\response-stream.js:88:34) at serve (D:\Programme\nodejs\node_global\node_modules\http-server\node_modules\ecstatic\lib\ecstatic.js:204:11) at D:\Programme\nodejs\node_global\node_modules\http-server\node_modules\ecstatic\lib\ecstatic.js:134:11 at FSReqWrap.oncomplete (fs.js:82:15)

I don't know why?

[XciD]

+1 on WIN10 with Chrome

[ggevgg]

+1 win 7, chrome, node 5.6.0

[bendzinks]

It works fine with older node.js version (5.4.1).

[J-F-Liu]

On my machine, the setHeader function receives the following arguments:

{ '0': 'server', '1': 'ecstatic-0.7.6' }
{ '0': 'content-type', '1': 'text/html' }
{ '0': 'etag', '1': '"844424930269763-0-Fri Sep 11 2015 23:22:46 GMT+0800 (中国标准时间)"' }

Seems 中国标准时间 are reported as invalid characters.

[wolfsilver]

http-servernode_modulesecstaticlibecstaticetag.js

module.exports = function (stat) {
  return JSON.stringify([stat.ino, stat.size, stat.mtime.toJSON()].join('-'));
}

[MagicZL]

@ wolfsilver it worked.

[vitalets]

+1 win7 ie10

[doricat]

@wolfsilver Thanks.
https://github.com/jfhbrook/node-ecstatic/blob/master/lib/ecstatic/etag.js

[indexzero]

@DoriCat @wolfsilver @MagicZL Not sure I follow the solution, but it sounds like it is a fix to ecstatic itself. Can you make a PR there with the update?

[wolfsilver]

you're welcome.

On Fri, Feb 19, 2016 at 1:13 PM, Tim Wang [email protected] wrote:

@wolfsilver https://github.com/wolfsilver Thanks.
https://github.com/jfhbrook/node-ecstatic/blob/master/lib/ecstatic/etag.js

—
Reply to this email directly or view it on GitHub
https://github.com/indexzero/http-server/issues/244#issuecomment-186053367
.

[wolfsilver]

the leatest version has solved the problem

On Fri, Feb 19, 2016 at 1:49 PM, Charlie Robbins [email protected]
wrote:

@DoriCat https://github.com/DoriCat @wolfsilver
https://github.com/wolfsilver @MagicZL https://github.com/MagicZL Not
sure I follow the solution, but it sounds like it is a fix to ecstatic
itself. Can you make a PR there with the update?

—
Reply to this email directly or view it on GitHub
https://github.com/indexzero/http-server/issues/244#issuecomment-186067379
.

[indexzero]

@wolfsilver the latest version of node solved it? or the latest version of ecstatic? I'm confused because this issue was opened 8 days ago and ecstatic hasn't changed since January.

[wolfsilver]

the latest version of ecstatic

check https://github.com/indexzero/http-server/blob/master/package.json#L64

maybe it still depends the older version.

[indexzero]

Ah that's it!

[indexzero]

Fixed and published in 0.9.0

[vitalets]

thanks :+1:

[stanJ]

Wow,my problem finally has been solved!!Thank you

[gggin]

good!

[gggin]

npm install -g http-server@latest
it said 0.9.0 but problem also has!

[sneakyfildy]

having the same issue, while running karma tests. Win 7 non-english, node -v 4.3.1, http-server 0.9.0

same whole stuff works well under ubuntu on my office box

same sh with node 5.9.0

[sneakyfildy]

Hey, ppl, check this out
http://i.imgur.com/bfcX5Ph.jpg

the function setNoCacheHeaders at the path node_moduleskarmalibmiddlewarecommon.js
has this:
response.setHeader('Expires', (new Date(0)).toString())

which contains mixed-encoding content (I mean random content) because Date.toString is unreliable

[gggin]

how to let http-server good?(no header bug) I found so many issue in different repo but I cannot find a way to fix it.

[Valerika]

gggin, thank you!!!

[gggin]

@Valerika you find a way to run good?

[Valerika]

Yes, helps upgrade http-server

[adrelino]

Hi, I got the same issue when using http-server (used from within grunt-http-server). But I traced the issue down to the npm module 'union', file response-stream.js.

Here is the stack trace as well as some additional log output before the program crashes:

adrian@adrian-i5:~/Projects/watcheeweb/track$ grunt -d --stack
Running "http-server:dev" (http-server) task
[D] Task source: /home/adrian/Projects/watcheeweb/track/node_modules/grunt-http-server/tasks/http-server.js
Server running on http://127.0.0.1:9999/
Hit CTRL-C to stop the server
[Sat, 01 Oct 2016 20:16:59 GMT] "GET /" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36"
Header key:  Content-Type  content:  text/html
[Sat, 01 Oct 2016 20:16:59 GMT] "GET /favicon.ico" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36"
Header key:  0  content:  N
Header key:  1  content:  o
Header key:  2  content:  t
Header key:  3  content:   
Header key:  4  content:  F
Header key:  5  content:  o
Header key:  6  content:  u
Header key:  7  content:  n
Header key:  8  content:  d
Header key:  bold  content:  Not Found
Fatal error: The header content contains invalid characters
TypeError: The header content contains invalid characters
  at ServerResponse.OutgoingMessage.setHeader (_http_outgoing.js:358:11)
  at ResponseStream.writeHead (/home/adrian/Projects/watcheeweb/track/**node_modules/union/lib/response-stream.js:77:21**)
  at Array.writeStatusCode (/home/adrian/Projects/watcheeweb/track/node_modules/http-proxy/lib/http-proxy/passes/web-outgoing.js:113:11)
  at ClientRequest.<anonymous> (/home/adrian/Projects/watcheeweb/track/node_modules/http-proxy/lib/http-proxy/passes/web-incoming.js:157:20)
  at emitOne (events.js:96:13)
  at ClientRequest.emit (events.js:188:7)
  at HTTPParser.parserOnIncomingClient [as onIncoming] (_http_client.js:472:21)
  at HTTPParser.parserOnHeadersComplete (_http_common.js:99:23)
  at Socket.socketOnData (_http_client.js:361:20)
  at emitOne (events.js:96:13)
  at Socket.emit (events.js:188:7)
  at readableAddChunk (_stream_readable.js:176:18)
  at Socket.Readable.push (_stream_readable.js:134:10)
  at TCP.onread (net.js:543:20)

Apparently the issue occurs e.g. when a requested file (e.g favicon.ico) is not found, the word Not found is actually written in bold characters on the stack trace console. But when passed to the setHeader function, the program crashes.

I changed the following function to get more log output about the header content:
node_modules/union/lib/response-stream.js:77

ResponseStream.prototype.writeHead = function (statusCode, headers) {
  if (headers) {
    for (var key in headers) {
      console.log("Header key: ",key, " content: ",headers[key]);  //line added by myself
      this.response.setHeader(key, headers[key]);
    }
  }

For now I just surrounded the function with try/catch so I can keep on developing my project, but I wanted to mention the problem here so it can be fixed some day. I don't know where is the right place to fix this issue...

My environment:

Ubuntu 16.04.1
node -v 6.7.0
npm list
[email protected]
[email protected]
[email protected]

[meastes]

@adrelino I'm seeing the same thing. It appears to be an issue with the union dependency, which unfortunately hasn't been updated in years.

[neagle]

I'm also getting this error. I'm using http-server as a simple proxy. The command I'm using is:

http-server build --proxy http://localhost:8003

I grabbed a curl command from Chrome's dev tools to hit the original address, and I get a successful result. Here's the verbose output:

curl 'http://localhost:8003/config/enabled' -H 'X-Requested-With: XMLHttpRequest' -H 'Referer: http://localhost:8080/last-chance/test/itcom.html' -H 'Origin: http://localhost:8080' -H 'X-apikey: ba2c7231-fb17-467c-9370-e20cb4736c9c' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36' -H 'Content-Type: application/json' --data-binary '{"productName":"VMware Fusion 8.x"}' --compressed -v

*   Trying ::1...
* Connected to localhost (::1) port 8003 (#0)
> POST /config/enabled HTTP/1.1
> Host: localhost:8003
> Accept: */*
> Accept-Encoding: deflate, gzip
> X-Requested-With: XMLHttpRequest
> Referer: http://localhost:8080/last-chance/test/itcom.html
> Origin: http://localhost:8080
> X-apikey: ba2c7231-fb17-467c-9370-e20cb4736c9c
> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
> Content-Type: application/json
> Content-Length: 35
>
* upload completely sent off: 35 out of 35 bytes
< HTTP/1.1 200 OK
< Access-Control-Allow-Origin: http://localhost:8080
< Content-Type: application/json; charset=utf-8
< Content-Length: 15
< ETag: W/"f-DwR5h0v29KcoEJmxXfJ8Jw"
< Date: Fri, 14 Oct 2016 20:35:41 GMT
< Connection: keep-alive
<
* Connection #0 to host localhost left intact
{"status":"ok"}%

But when I change that to the proxied port (8080), I get this error:

"POST /config/enabled" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36"

_http_outgoing.js:358
    throw new TypeError('The header content contains invalid characters');
    ^

TypeError: The header content contains invalid characters
    at ServerResponse.OutgoingMessage.setHeader (_http_outgoing.js:358:11)
    at ResponseStream.writeHead (/Users/nate/Sites/last-chance/node_modules/union/lib/response-stream.js:75:21)
    at Array.writeStatusCode (/Users/nate/Sites/last-chance/node_modules/http-proxy/lib/http-proxy/passes/web-outgoing.js:120:11)
    at ClientRequest.<anonymous> (/Users/nate/Sites/last-chance/node_modules/http-proxy/lib/http-proxy/passes/web-incoming.js:159:20)
    at emitOne (events.js:96:13)
    at ClientRequest.emit (events.js:188:7)
    at HTTPParser.parserOnIncomingClient [as onIncoming] (_http_client.js:474:21)
    at HTTPParser.parserOnHeadersComplete (_http_common.js:99:23)
    at Socket.socketOnData (_http_client.js:363:20)
    at emitOne (events.js:96:13)

I've run the header keys and values through this validator and there don't seem to be any issues. Anyone have any insight?

[rems75]

I was getting the exact same error on one of my computers, not on another.
I traced it back to the version of http-proxy used by http-server (that one is 0.9.0 on both). It works with 1.14.0, not with 1.15.1 (and copying the http-server exec from one to the other solved the issue).
Haven't checked the exact origin of the problem, but figured I should share this.

[erigo]

@rems75 it works! thanks!

[neagle]

@rems75 This fix works for me, too. Sounds like we've got an issue with the http-proxy project. Looks like it might be related to this? https://github.com/nodejitsu/node-http-proxy/issues/1064

[kevinkid]

Remove express req headers configurations from your server side code.