http2: add strictSingleValueFields option to allow relaxing header validation

[pimterry]

Fixes #59651

Previously it was impossible to send multiple values for any header or trailer defined officially as supporting only a single value.

This is a reasonable default, but in practice many of these headers are used in the wild in weird & wonderful ways, where this limitation can be problematic. This is also inconsistent with Node's equivalent HTTP/1 behaviour, which has no such restriction.

This PR add a new option which allows for relaxing this restriction, to support the edge cases where this is helpful, but defaulting to true to preserve the existing behaviour. This is stored on the session, and added for both clients & servers via connect() and create[Secure]Server().

---

Aside: as mentioned in #59651, I do think it might be interesting to consider unifying the insecure/relaxed validation options and linking them to --insecure-http-parser in future, to better match them to the corresponding HTTP/1 behaviour for people in scenarios where they want to more easily handle weird HTTP and accept the implications, but doing so for strictFieldWhitespaceValidation would be a breaking change anyway and there was no immediate enthusiasm for the suggestion there, so we can leave this for another day.

[nodejs-github-bot]

Review requested:

• @nodejs/http
• @nodejs/http2
• @nodejs/net

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.72%. Comparing base (1523d66) to head (a475247).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #59917      +/-   ##
==========================================
- Coverage   89.73%   89.72%   -0.02%     
==========================================
  Files         675      675              
  Lines      204797   204858      +61     
  Branches    39357    39357              
==========================================
+ Hits       183778   183806      +28     
- Misses      13291    13337      +46     
+ Partials     7728     7715      -13     

Files with missing lines	Coverage Δ
lib/internal/http2/core.js	95.24% <100.00%> (+0.05%)	⬆️
lib/internal/http2/util.js	92.79% <100.00%> (+0.09%)	⬆️
lib/internal/quic/quic.js	100.00% <100.00%> (ø)

... and 30 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pimterry]

Would love to get a review from @nodejs/http2 here please.

[pimterry]

One tidy real-world example of this issue another user just reported in one of my libraries:

curl -I https://tech.unblockedgames.world/ 
    
HTTP/2 200 
date: Fri, 31 Oct 2025 10:09:56 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
x-permitted-cross-domain-policies: master-only
x-permitted-cross-domain-policies: master-only
referrer-policy: same-origin
referrer-policy: same-origin
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=IZ%2FpFHZUxgwOsymwKUZA7pAqP3qzhb%2BOlDMZfuLxhe9PtpacWHsAdMWVKgNiyWD%2BzP5EztuRLIWn7uCdRyMEv%2FHIcowiAH4LYKowyeLzM%2B9m%2FaZhNq3D"}]}
cf-ray: 99725c16d9ebcf94-MAD
alt-svc: h3=":443"; ma=86400

The various security options here are duplicated, but officially should only appear once.

It's impossible to accurately proxy this traffic with HTTP/2 in Node.js without the option added by this PR - the duplicated security headers are sent successfully by the real server, and accepted happily by browsers & curl as clients, but Node blocks them. I'd love to get this fixed!

It seems we don't have many reviews for HTTP/2. Maybe somebody on @nodejs/http would be open to taking a look at this?

[eldhosejoys]

curl -I https://tech.unblockedgames.world/ 
    
HTTP/2 200 
date: Fri, 31 Oct 2025 10:09:56 GMT
cf-ray: 99725c16d9ebcf94-MAD
alt-svc: h3=":443"; ma=86400

Also HTTP/2 status message is also missing.

[nutterthanos]

@pimterry also review from @nodejs/TSC and or @nodejs/web-server-frameworks now since nodejs/http2 is dead as well

[pimterry]

Thanks for the review @Qard! I had forgotten about this and it was stale, conflicting with main in the docs.

I've just forced pushed a rebase, can you please review again? Thanks.