Note that parsing is likely more complicated than your code because you have assumed that your “line” has already been identified before parsing the line. AFAIK

Note that parsing is likely more complicated than your code because you have assumed that your “line” has already been identified before parsing the line. AFAIK there is an escape sequence for the header delineator (\r\n). Also, your code doesn’t fix the issue where a header name with a white space is accepted (which may violate expectations, depending on the server). Your pseudo code also doesn’t handle edge cases where 2 headers which normalize to the same stripped text collide. One HTTP smuggling vector is the front server keeping a different header value than the back server when 2 header names collide.