Is it possible to include multiple CRLFs in a HTTP header-field?

Question

Below is HTTP-message definition in latest HTTP RFC 7230

 HTTP-message   = start-line
                  *( header-field CRLF )
                  CRLF
                  [ message-body ]

Below is definition of header-field,

 header-field   = field-name ":" OWS field-value OWS

 field-name     = token
 field-value    = *( field-content / obs-fold )
 field-content  = field-vchar [ 1*( SP / HTAB ) field-vchar ]
 field-vchar    = VCHAR / obs-text

 obs-fold       = CRLF 1*( SP / HTAB )

..and:

obs-text       = %x80-FF

..and ABNF's:

 VCHAR          =  %x21-7E
                                 ; visible (printing) characters

As we can see, field-value could have multiple obs-folds and obs-folds has one CRLF. It is strange for me for I think CRLF is the end of a header line. Is there an example that multiple CRLFs are encoded into one header-field? Or, do I misunderstand the definition?

Answer 1

Your understanding of the standard is correct. In the past, multi-line header values were supported under RFC 2616. This feature was known as "Line Folding":

HTTP/1.1 header field values can be folded onto multiple lines if the continuation line begins with a space or horizontal tab. All linear white space, including folding, has the same semantics as SP. A recipient MAY replace any linear white space with a single SP before interpreting the field value or forwarding the message downstream.

So the following two forms are equivalent:

Header: value1, value2

Header: value1,
        value2

The newer RFC 7230 explicitly deprecates this. In fact the "obs" in "obs-fold" stands for "obsolete".

Historically, HTTP header field values could be extended over multiple lines by preceding each extra line with at least one space or horizontal tab (obs-fold). This specification deprecates such line folding except within the message/http media type (Section 8.3.1). A sender MUST NOT generate a message that includes line folding (i.e., that has any field-value that contains a match to the obs-fold rule) unless the message is intended for packaging within the message/http media type.

So although I've never seen this feature in practice (or at least haven't noticed it), it exists. Moreover, it seems that line folding wasn't even completely deprecated, and its use is still allowed for the HTTP media type header.

Multi-line headers are still supported by standard HTTP header parsers in languages such as PHP [arv], Java, and Go.

The only concrete example I managed to find of such a header was in this technet blog post which has this image:

Note the yellow 0d 0a (carriage return, line feed) WITHIN the Content-Type header.