title: security for http headers
body: <p>We'd like to double-check our http headers for security before we send them out. Obviously we can't allow '\r' or '\n' to appear, as that would allow content injection. </p>
  
  <p>I see just two options here:</p>
  
  <ol>
  <li>Truncate the value at the newline character.</li>
  <li>Strip the invalid character from the header value.</li>
  </ol>
  
  <p>Also, from reading <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2" rel="nofollow">RFC2616</a>, it seems that only ascii-printable characters are valid for http header values Should also I follow the same policy for the other 154 possible invalid bytes?  </p>
  
  <p>Or, is there any authoritative prior art on this subject?</p>