Skip to content

http: escape non-ASCII characters in HX-Trigger and HX-Location JSON - #109

Merged
rameel merged 3 commits into
mainfrom
http/escape-non-ascii-headers
Oct 28, 2026
Merged

rameel merged 3 commits into
mainfrom
http/escape-non-ascii-headers

Conversation

@rameel

@rameel rameel commented Oct 28, 2026

Copy link
Copy Markdown
Owner

No description provided.

JSON written into response headers used the encoder meant for HTML
attributes, which leaves all Unicode ranges unescaped.

Response headers allow only ASCII, so a non-ASCII event name, event
detail, or HX-Location option, such as
TriggerEvent("saved", new { Name = "Привет" }), failed with "Invalid
non-ASCII or control character in header" and the request returned 500.
This is a regression from 1.2.2.

Write header JSON with the default encoder, as 1.2.2 did. HTML
attributes keep the encoder that preserves Unicode characters.
@rameel
rameel merged commit 7fa27ca into main Oct 28, 2026
1 check passed
@rameel
rameel deleted the http/escape-non-ascii-headers branch October 28, 2026 13:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant