Byte Array as Custom HTTP Header Encoding?

Question

I want to add custom HTTP Header(hashed and signed) encoded in utf8 encoding (Encoding.UTF8.GetString). When the data is POSTed to IIS, Bad Request(400) error is encountered.

If the custom HTTP Header is encoded in base64 encoding, and there's no problem. But our partner is insisting to use utf8 encoding.

I want to know whether this "Bad Request(400)" is only caused by IIS?

And here is the code:

    var client = new HttpClient();
    client.DefaultRequestHeaders.Accept.Add(new 
    MediaTypeWithQualityHeaderValue("application/json"));
    HttpRequestMessage msg = new HttpRequestMessage(HttpMethod.Post, 
             "https://putsreq.com/AIWKVacHh2ok5FMGFpEg");
    var reqBody = "{'hello': 'world'}";
    msg.Content = new StringContent(reqBody);
    msg.Content.Headers.ContentType = new 
         MediaTypeWithQualityHeaderValue("application/json");
    var signature = SignMessage(reqBody); //hash and sign the message using 
                                          //private key
    var signatureString = Encoding.UTF8.GetString(signature); 
    msg.Headers.Add("signature", signature);
    try{
        var response = await client.SendAsync(msg);
        response.EnsureSuccessStatusCode();
        //Continue if success
   }catch(Exception ex){
        Trace.WriteLine("Exception: " + ex);
   }

Can you show us the way how you construct and send your custom header? — thehennyy
– thehennyy, Commented Aug 28, 2018 at 9:28
"Our partner is insisting to use UTF8 encoding" is a red flag. UTF8 data might contain invalid characters for headers, which can be the cause of 400, tools.ietf.org/html/rfc7231#section-6.5.1 You can capture the request and analyze (developer tools of your browser, or Fiddler, or Wireshark). Base64, contrarily, is the safe way to go. — Lex Li
– Lex Li, Commented Aug 28, 2018 at 12:16
@LexLi Thanks for the info. Can you edit your comment as the answer? — John Hpa
– John Hpa, Commented Aug 29, 2018 at 2:07

Community · Accepted Answer · 2021-10-07 11:19:07Z

1

Copied from comment.

HTTP headers have strict rules on what characters can appear,

https://www.rfc-editor.org/rfc/rfc7231#section-6.5.1

UTF8 data might contain invalid characters for headers, which can trigger such 400 errors. You can capture the request and analyze (developer tools of your browser, or Fiddler, or Wireshark).

Base64, contrarily, is the safe way to go. And standards like Basic authentication do use Base64 to encode user credentials.

edited Oct 7, 2021 at 11:19

CommunityBot

11 silver badge

answered Aug 29, 2018 at 2:10

Lex Li

64k12 gold badges126 silver badges163 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Byte Array as Custom HTTP Header Encoding?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related