title: what characters are allowed in HTTP header values?
body: <p>After studying <a href="https://www.ietf.org/rfc/rfc2616.txt" rel="noreferrer">HTTP/1.1 standard</a>, specifically page 31 and related I came to conclusion that any 8-bit octet can be present in HTTP header value. I.e. any character with code from [0,255] range.</p>
  
  <p>And yet HTTP servers I tried refuse to take anything with code > 127 (or most US-ASCII non-printable chars).</p>
  
  <p>Here is dried out excerpt of grammar used in standard:</p>
  
  <pre><code>message-header = field-name ":" [ field-value ]
  field-name     = token
  field-value    = *( field-content | LWS )
  field-content  = &lt;the OCTETs making up the field-value and consisting of
                    either *TEXT or combinations of token, separators, and
                    quoted-string&gt;
  
  CR             = &lt;US-ASCII CR, carriage return (13)&gt;
  LF             = &lt;US-ASCII LF, linefeed (10)&gt;
  SP             = &lt;US-ASCII SP, space (32)&gt;
  HT             = &lt;US-ASCII HT, horizontal-tab (9)&gt;
  CRLF           = CR LF
  LWS            = [CRLF] 1*( SP | HT )
  OCTET          = &lt;any 8-bit sequence of data&gt;
  CHAR           = &lt;any US-ASCII character (octets 0 - 127)&gt;
  CTL            = &lt;any US-ASCII control character (octets 0 - 31) and DEL (127)&gt;
  TEXT           = &lt;any OCTET except CTLs, but including LWS&gt;
  
  token          = 1*&lt;any CHAR except CTLs or separators&gt;
  separators     = "(" | ")" | "&lt;" | "&gt;" | "@" | "," | ";" | ":" | "\"
                 | &lt;"&gt; | "/" | "[" | "]" | "?" | "=" | "{" | "}" | SP | HT
  
  quoted-string  = ( &lt;"&gt; *(qdtext | quoted-pair ) &lt;"&gt; )
  qdtext         = &lt;any TEXT except &lt;"&gt;&gt;
  quoted-pair    = "\" CHAR
  </code></pre>
  
  <p>As you can see <code>field-content</code> can be a <code>quoted-string</code>, which is an enquoted sequence of <code>TEXT</code> (i.e. any 8-bit octet with exception of <code>"</code> and values from <code>[0-8, 11-12, 14-31, 127]</code> range) or <code>quoted-pair</code> (<code>\</code> followed by any value from <code>[0, 127]</code> range). I.e. any 8-bit char sequence can be passed by en-quoting it and prefixing special symbols with <code>\</code>).</p>
  
  <p>(Note that standard doesn't treat <code>NUL(0x00)</code> char in any special way)</p>
  
  <p>But, obviously either all servers I tried are not conforming or standard has changed since 1999 or I can't read it properly.</p>
  
  <p>So... which characters are allowed in HTTP header values and why?</p>
  
  <p>P.S. Reason behind all of this: I am looking for a way to pass utf-8-encoded sequence in HTTP header value (without additional encoding, if possible).</p>