HTTP Headers that contains underscore (_) are not transferred to server

The following could be an HTTP specification, but I'm not sure. 

I have netcat opened, submitting the following request via httpie[https://github.com/jkbr/httpie] 

``` bash
http POST http://cas/api/v1/users/ X_SPIL_AUTH_TOKEN:test
```

results as the following

```
POST /api/v1/users/ HTTP/1.0
Host: cas
X-Real-IP: 127.0.0.1
Connection: close
Content-Length: 0
User-Agent: HTTPie/0.4.1
Accept: */*
Accept-Encoding: gzip, deflate, compress
```

and submitting the following request

``` bash
http POST http://cas/api/v1/users/ X-SPIL-AUTH-TOKEN:test
```

ends up with the following result

```
POST /api/v1/users/ HTTP/1.0
Host: cas
X-Real-IP: 127.0.0.1
Connection: close
Content-Length: 0
User-Agent: HTTPie/0.4.1
Accept-Encoding: gzip, deflate, compress
Accept: */*
X-SPIL-AUTH-TOKEN: test
```


Here's the [spec](http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2). In case you were unsure, I'm 90% sure (assuming my memory still works... probably need to run an fsck some time soon) that HT is short-hand for hyphen (or hyphen text). In other words, underscores are not allowed in header field names. They can exist in the field values, just not the names. If you want translation from `_` to `-`, that would be an issue to raise against jkbr/httpie.


Thanks for the clarification. I was using httpie to make sure my code wasn't the problem. Apparently the cause was my key selection.


Just for my own paranoia:

```
iapetus:~ curl -H "Underscored_Name: Foo" http://httpbin.org/get
{
  "url": "http://httpbin.org/get",
  "headers": {
    "Host": "httpbin.org",
    "Underscored-Name": "Foo",
    "Connection": "close",
    "Accept": "*/*",
    "User-Agent": "curl/7.21.4 (x86_64-unknown-linux-gnu) libcurl/7.21.4 OpenSSL/0.9.8n zlib/1.2.5 libidn/1.19"
  },
  "args": {},
  "origin": "10.84.89.222"
}
```

You'll see that cURL translated the underscore to a hyphen which only raises my confidence that they can not exist. jkbr/httpie tries to replace cURL so you might want to bring this up as a feature request, but this is certainly not a bug.

Thanks for the report though.


HT stands for horizontal tab, [see here](http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2).


If I check it with tcpdump, I see that it's not cURL that translates the underscore but httpbin.org's software. According to any standard I found, you can use any printable character in a header name except colon, so nothing warrants turning underscores to anything else or denying them.


Then requestb.in is doing something wrong too. It's translating curl requests with underscores to hyphens. If you don't trust me you can create an anonymous bin that will last for 20 minutes.


It seems a lot of software is handling headers with underscores specially. I found reports about nginx, IIS and some ruby stuff.
OTH, using primitive tools like netcat one can easily proof, that curl happily sends headers containing underscores:

``` sh
$ curl -H "Underscored_Name: Foo" http://localhost:4000
```

``` sh
$ ncat -l 0.0.0.0 4000 # also works with "netcat" and "nc". Doesn't care about protocols or standards
GET / HTTP/1.1
User-Agent: curl/7.31.0
Host: localhost:4000
Accept: */*
Underscored_Name: Foo
```


I am having same problem & i am using xampp 1.8.0

This is not working

<pre>
curl -i -H "Accept: application/json" -H "X_REST_USERNAME: admin@restuser" -H "X_REST_PASSWORD: admin@Access"\http://localhost/project/api/test
</pre>

This is working.

<pre>
curl -i -H "Accept: application/json" -H "X-REST-USERNAME: admin@restuser" -H "X-REST-PASSWORD: admin@Access" \ http://localhost/project/api/test
</pre>


@miteshsc Sorry, but how is that comment relevant to this issue?


@Lukasa: Sorry for posting irrelevant comment but i was facing problem, thats why i have posted my cUrl call.


SiteMinder not setting HTTP header with underscore in the name in Apache 2.4
Document ID:  TEC1712544
Last Modified Date:  1/22/2016
Show Technical Document Details
Problem:
Customer installed and configured SiteMinder Web Agent on Apache 2.4.
He has a PHP module which is expecting some of the default SiteMinder headers e.g. SM_USER, SM_DOMAIN etc and also some custom headers which has underscore in it's name (e.g USER_NAME etc).
However, when he reads the HTTP headers using PHP module (or a CGI module) , he couldn't find any of the header with underscore in it's name being set.
All other headers are working fine.

Environment:
Policy Server : r12.52 SP1 CR2 (However, this is applicable for any version)

Root Cause:
This is a new feature introduced in Apache 2.4 in multiple modules like mod_cgi,mod_include,mod_isapi,php etc.
This was introduced to prevent cross-site-scripting attacks via header injection. Headers containing invalid characters (including underscores) are now silently dropped

Resolution: 
For the default SiteMinder Headers
You can specify which naming convention the Web Agent uses for the default HTTP headers with the following parameter:

LegacyVariables
Specifies if the Web Agent uses underscores in HTTP header names.

When ,
LegacyVariables = yes (default), the HTTP Headers will have underscore (e.g SM_USER,SM_USERDN etc)
LegacyVariables = no, the HTTP headers will not have underscores (e.g SMUSER,SMUSERDN)

For custom HTTP Headers
LegacyVariables only controls the default SiteMInder HTTP headers. It doesn't modify the user defined HTTP Headers.
So. for bypassing this restriction in Apache 2.4, you will need to ensure that your custom HTTP header names does not have any undersore.

Alternatively, you can also refer to the workaround suggested by Apache, which will bascially bypass this new security restriction.
This involves setting mod_setenvif and mod_headers which allows you to still accept these headers with underscore.


@josetiagobispo this seems not at all relevant to this project. Please do not post bug reports related to other projects on this projects issue tracker.


Due to the recent spam on this issue, I'm locking the conversation down.