Floot Endpoint Response Header Sanitizer

• 01Normalizes reviewed allowed names to lowercase and rejects malformed, overlong, forbidden, or empty configuration.
• 02Accepts only HTTP token header names that appear in the configured allowlist.
• 03Rejects carriage return and line feed values instead of repairing newline injection and never echoes rejected values in findings.
• 04Removes other C0 control characters and DEL with an explicit warning before applying a UTF-8 value-byte bound.
• 05Rejects duplicate dynamic names and denies connection, content-length, transfer-encoding, set-cookie, and other runtime-managed names.
• 06Returns immutable lowercase records, counts, stable issue codes, and a non-policy boundary while performing no response construction or I/O.

• 01Floot endpoints mapping a request trace or result state into reviewed response headers
• 02Node and serverless handlers requiring bounded dynamic header metadata
• 03Teams separating header-shape validation from security policy, cookies, authorization, and disclosure approval

This listing is a downloadable Genesis code package. The ZIP includes reusable code and START-HERE directions.

1. 01

   Define the endpoint allowlist

   List only the dynamic names that one reviewed endpoint is designed to return and keep cookie or security-policy construction in dedicated host modules.

2. 02

   Sanitize before construction

   Map intentional non-sensitive strings, run the helper, and stop or omit dynamic headers when the result is not ok.

3. 03

   Verify the deployed response

   Exercise injection, Unicode, duplicate, error, and cache paths, inspect final production headers, publish through the host workflow, and retain rollback.