2026-09-13 · 6 min read · Rahul Chitturi
- http
- headers
- interoperability
HTTP Structured Fields define typed dictionaries, lists, and items for headers that opt into the format. Treating one as a comma-split string loses quoting, byte sequences, booleans, decimals, inner lists, and parameters.
The field's specification selects its top-level type and semantic rules. A generic parser cannot infer whether an unknown field should be a dictionary, list, or item.
Preserve the received field-value sequence
Capture header values through an API that preserves their intended combination semantics. Intermediaries may combine repeated field lines, but quoted strings and inner lists mean commas are not safe manual delimiters.
- Select the parser mode from the registered field definition.
- Reject invalid syntax instead of repairing it silently.
- Keep parameter keys separate from bare item values.
- Enforce implementation limits on members and lengths.
Do not invent a signing canonicalization
A serializer can produce a valid normalized representation, but security protocols define exactly which received or derived components are signed. Re-serializing a field before verification is correct only when that protocol explicitly requires it.
Byte sequence items use the format's base64 representation, which is another layer from the enclosing HTTP message. Keep decoding and semantic validation separate.
Compare implementations with public vectors
Use URL tool for safe request targets, Base64 for disposable byte items, hash for exact fixture identity, and diff for parser outputs. Use a standards-aware library for production parsing.
Test repeated lines, whitespace, quoted commas, duplicate dictionary keys, booleans, decimals, dates, byte sequences, inner lists, parameters, invalid escapes, oversized values, and proxy round trips.