Why does an HTTP header still reject cleaned text?

Measured inputs and outputs

These are locally constructed test strings, not evidence that Claude inserts these characters. We executed the saved homepage script snapshot with a minimal DOM harness and compared exact strings. The invisible-checkbox state and dash mode appear in each row. The observations below test this page's specific question. File API and event-lifecycle tests include an additional stage described in the analysis. We make no detector-score or statistical-watermark removal claim.

The destination validator is measured separately

Our observer calls Node validateHeaderValue with the fixed name X-Test and each exact string. U+200B is rejected initially and accepted after cleanup produces AB. The CRLF fixture remains rejected because those two characters are retained. U+200D is also retained and rejected. The plain AB reference passes both times. We make no HTTP request and send no header to a server. This is a local validation experiment, with the saved error code distinguishing rejection from the cleaner status. It tests neither header names nor an entire HTTP message.

A text operation is not a transport policy

Node documents header-value validation and its invalid-character error behavior. The homepage operates on strings for a broader editing workflow; it has no knowledge of header grammar or transport restrictions. Retaining ordinary document line breaks is useful in prose but insufficient for a header value. Other HTTP clients may enforce different representations or add their own checks. Our result is specific to the recorded Node implementation and these inputs. A valid header value also does not mean that its application meaning is appropriate or that placing a particular field in a request is authorized.

Construct headers through the intended client

Keep untrusted text out of header fields unless the field specification and application policy allow it. Use the HTTP client validator for the actual destination and reject unexpected controls before constructing a message. Do not infer transport safety from a no-findings status or blindly strip line breaks from a whole document. If a legitimate value fails, inspect its exact sequence and determine the required encoding or allowed field syntax. Retain the rejection record and rerun validation after a deliberate repair. This page provides reproducible local evidence, not a general-purpose header filtering algorithm or security certification.

Reproduce this test

Save reproduce.cjs and tested-app.js in the same folder. Run the command below with Node.js. The harness prints its runtime, script SHA-256 and every measured row. Compare those rows with the original record. Using a newer script or runtime creates a new experiment; retain the version information with your rerun.

node reproduce.cjs