Skip to content

Navigation Menu

Appearance settings

- AI CODE CREATION
  GitHub CopilotWrite better code with AI
  GitHub Copilot appDirect agents from issue to merge
  MCP Registry^NewIntegrate external tools
- DEVELOPER WORKFLOWS
  ActionsAutomate any workflow
  CodespacesInstant dev environments
  IssuesPlan and track work
  Code ReviewManage code changes
- APPLICATION SECURITY
  GitHub Advanced SecurityFind and fix vulnerabilities
  Code securitySecure your code as you build
  Secret protectionStop leaks before they start
- EXPLORE
  Why GitHub
  Documentation
  Blog
  Changelog
  Marketplace
View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
View all resources
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  GitHub Stars
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

serverpod / relic Public

Notifications You must be signed in to change notification settings
Fork 14
Star 124

Code
Issues 42
Pull requests 4
Actions
Projects
Security and quality
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Projects
Security and quality
Insights

feat: RFC compliant typed headers#360

Open

nielsenko wants to merge 75 commits into

serverpod:mainserverpod/relic:mainfrom

nielsenko:feat-rfc-compliant-headersnielsenko/relic:feat-rfc-compliant-headersCopy head branch name to clipboard

Conversation Commits75 (75)Checks Files changed

Open

feat: RFC compliant typed headers#360
nielsenko wants to merge 75 commits into
serverpod:mainfrom
nielsenko:feat-rfc-compliant-headers

Commits

Commits on Jun 12, 2026

feat(headers): add Token interface with tchar validation
nielsenko
committed
feat(headers): add HeaderScanner with token/quoted-string readers and quote-aware splitting
nielsenko
committed
feat(headers): add DeltaSeconds primitive for non-negative second counts
nielsenko
committed
feat(headers): add Host primitive (uri-host with optional port)
nielsenko
committed
feat(headers): add Origin primitive with explicit opaque (null) sentinel
nielsenko
committed
feat(headers): add LanguageTag primitive (BCP 47)
nielsenko
committed
feat(headers): add ETagValue primitive with etagc validation and match helpers
nielsenko
committed
feat(headers): add ParameterValue primitive (token/quoted-string)
nielsenko
committed
fix(headers): enforce Content-Range invariants and stop null leaking into output
nielsenko
committed
fix(headers): HostHeader.fromUri keeps null port for default-port URIs
nielsenko
committed
fix(headers): Access-Control-Allow-Origin uses Origin with explicit null sentinel
nielsenko
committed
fix(headers): Set-Cookie Domain uses Host, Path uses String
nielsenko
committed
fix(headers): Upgrade protocol version is a Token, not a double
nielsenko
committed
fix(headers): Digest encoder emits algorithm/qop/nc/stale as bare tokens
nielsenko
committed
fix(headers): Permissions-Policy emits origins as sf-strings
nielsenko
committed
fix(headers): Accept parses q-value as a named parameter
nielsenko
committed
fix(headers): Accept-Encoding tolerates OWS around q-value
nielsenko
committed
fix(headers): Accept-Language tolerates OWS around q-value
nielsenko
committed
fix(headers): TE tolerates OWS around q-value
nielsenko
committed
fix(headers): remove non-spec 'nested-navigate' from Sec-Fetch-Mode
nielsenko
committed
fix(headers): Clear-Site-Data recognizes clientHints value
nielsenko
committed
fix(headers): If-Range rejects weak ETags
nielsenko
committed
fix(headers): Cookie splits on first '=' and preserves opaque values
nielsenko
committed
fix(headers): Expect preserves unknown expectations
nielsenko
committed
fix(headers): harden Set-Cookie parser/encoder (positional parse, list encoder, Domain/Path validation)
nielsenko
committed
fix(headers): correct Digest scheme separator, token params, and quoting
nielsenko
committed
fix(headers): HostHeader.fromUri preserves IPv6 brackets
nielsenko
committed
fix(headers): anchor Content-Range parse regex
nielsenko
committed
fix(headers): Permissions-Policy quote-aware parse and CTL-safe render
nielsenko
committed
fix(headers): Expect rejects control characters
nielsenko
committed
fix(headers): validate IPv6 literals in Host; reject userinfo/controls in Origin
nielsenko
committed
fix(headers): DeltaSeconds.parse clamps over-large values
nielsenko
committed
fix(headers): distinct hashCodes for OpaqueOrigin and Allow-Origin wildcard
nielsenko
committed
test(headers): move Transfer-Encoding parse/encode cases to relic_core unit tests
nielsenko
committed
fix(headers): Host rejects control characters and invalid host characters
nielsenko
committed
fix(headers): remove non-spec clientHints from Clear-Site-Data
nielsenko
committed
fix(headers): Content-Range rejects overflowing numeric fields
nielsenko
committed
fix(headers): Permissions-Policy rejects unbalanced inner-list and empty feature name
nielsenko
committed
fix(headers): Set-Cookie encoder always emits the cookie-pair (empty-name round-trip)
nielsenko
committed
fix(headers): Digest validates unquoted auth-param values as tokens
nielsenko
committed
fix(headers): HostHeader factory rejects empty host and uses FormatException for port
nielsenko
committed
refactor(headers): share q-value formatter and truncate to 3 digits
nielsenko
committed
fix(headers): Expect allows HTAB; correct LanguageTag docstring example
nielsenko
committed
fix(headers): Content-Encoding accepts any token coding, case-insensitive
nielsenko
committed
fix(headers): Accept-Ranges models a list of range units
nielsenko
committed
fix(headers): Transfer-Encoding case-insensitive; reject chunked-not-last instead of reordering
nielsenko
committed
fix(headers): Authorization case-insensitive scheme dispatch and allow empty Basic password
nielsenko
committed
fix(headers): HSTS case-insensitive directives, quoted and non-negative max-age
nielsenko
committed
fix(headers): Referrer-Policy parses a token list and keeps the last valid value
nielsenko
committed
fix(headers): COEP/COOP accept report-to parameter; COOP adds noopener-allow-popups
nielsenko
committed
fix(headers): Content-Language validates via LanguageTag (full BCP 47)
nielsenko
committed
fix(headers): Retry-After delay rejects signs via delta-seconds parsing
nielsenko
committed
test(headers): Range accepts inverted byte ranges; consumer returns 416
nielsenko
committed
fix(headers): Cache-Control name-exact directives, reject negative deltas, drop false exclusion
nielsenko
committed
fix(headers): Vary field names compare case-insensitively
nielsenko
committed
fix(headers): CORS Allow-Headers/Expose-Headers compare field names case-insensitively
nielsenko
committed
fix(headers): CSP directive names compare case-insensitively
nielsenko
committed
fix(io): copy Transfer-Encoding codings into a growable list before appending chunked
nielsenko
committed
fix(headers): Cookie preserves duplicate cookie names instead of rejecting
nielsenko
committed
fix(headers): malformed q-value defaults to weight 1.0 instead of rejecting
nielsenko
committed
test(headers): unit-cover TE/Connection validation that dart:io 3.13 intercepts over a socket
nielsenko
committed
fix(headers): If-Range/From/Cache-Control degrade on malformed input; Sec-Fetch kept strict with corrected docs
nielsenko
committed
fix(headers): From is a single mailbox (RFC 9110 10.1.2), not a list
nielsenko
committed
fix(headers): ETagHeader parses via the ETagValue primitive (etagc validation)
nielsenko
committed
fix(headers): reject control characters when serializing Digest and report-to quoted values
nielsenko
committed
fix(headers): Digest nc must be exactly 8 hex digits (RFC 7616)
nielsenko
committed
fix(headers): Content-Range constructor rejects negative members
nielsenko
committed
fix(headers): Accept-Ranges rejects none combined with other range units
nielsenko
committed
fix(headers): Permissions-Policy validates feature names as tokens
nielsenko
committed
fix(headers): Content-Language stores the canonical-cased language tag
nielsenko
committed
fix(headers): Cache-Control ignores unknown extension directives (RFC 9111 5.2)
nielsenko
committed
style(headers): brace the multi-line if in Host IPvFuture validation
nielsenko
committed
test(headers): assert path-specific Allow-Origin rejection reason
nielsenko
committed
fix(headers): HSTS tolerates OWS around the directive '='
nielsenko
committed
fix(headers): LanguageTag rejects duplicate variants and extension singletons (BCP 47)
nielsenko
committed

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.