Santandersecurityresearch/DrHeader

Remove case validators in headers

javixeneize opened this issue · 2 comments

According to RFC 2616 https://www.w3.org/Protocols/rfc2616/rfc2616.html and their updates (7230-7237), headers are not case sensitive.

The tool is doing an exact match between rules and values received, so it should do a case insensitive validation

this is a good idea , heres a direct link to the relevant section
https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2

which has been replaced by

Each header field consists of a case-insensitive field name followed
by a colon (":"), optional leading whitespace, the field value, and
optional trailing whitespace.

https://tools.ietf.org/html/rfc7230#section-3.2