Managed HttpListener accepts whitespace around request header names #132128

Description

The managed HttpListener implementation normalizes malformed request header names by trimming them:

string name = header.AsSpan(0, colon).Trim().ToString();

HTTP requires the field name to be immediately followed by : . A server must reject request messages containing whitespace between the field name and colon with 400 Bad Request. The managed implementation should validate the field name without trimming it. Optional ASCII spaces and tabs around the field value should continue to be removed.

Tests should cover valid headers and malformed names containing leading whitespace or whitespace before the colon.

Reproduction Steps

Send a request containing header : value.

Expected behavior

It should be rejected with 400 Bad Request.

Actual behavior

The request reaches the application with the header normalized to header .

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response