HTTP headers are generally treated as ASCII, and Golang's decision to treat them as UTF-8 opens the gate to a range of issues, including the linked unicode norm

HTTP headers are generally treated as ASCII, and Golang's decision to treat them as UTF-8 opens the gate to a range of issues, including the linked unicode normalization attack.