Add notice for metadata value validation (tus#161)

nigoroll · Sep 16, 2020 · f0fadd5 · f0fadd5
1 parent 5646c29
commit f0fadd5
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/protocol.md b/protocol.md
@@ -330,6 +330,10 @@ ASCII encoded and the value MUST be Base64 encoded. All keys MUST be unique.
 The value MAY be empty. In these cases, the space, which would normally separate
 the key and the value, MAY be left out.
 
+Since metadata can contain arbitrary binary values, Servers SHOULD
+carefully validate metadata values or sanitize them before using them
+as header values to avoid header smuggling.
+
 #### Requests
 
 ##### POST