# Internal server error triggered by "Accept-Charset" header with unexpected value

**URL:** <https://discuss.akka.io/t/internal-server-error-triggered-by-accept-charset-header-with-unexpected-value/10427>\
**Category:** Akka Libraries\
**Tags:** akka-http\
**Created:** [August 9, 2023, 8:34am UTC](https://discuss.akka.io/t/internal-server-error-triggered-by-accept-charset-header-with-unexpected-value/10427 "2023-08-09T08:34:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![abjrnxaxa](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.akka.io/abjrnxaxa/32/3055_2.png) [@abjrnxaxa](https://discuss.akka.io/u/abjrnxaxa)\
**Post date:** [August 9, 2023, 8:34am UTC](https://discuss.akka.io/t/internal-server-error-triggered-by-accept-charset-header-with-unexpected-value/10427/1 "2023-08-09T08:34:15Z")

</div>

Hello!

In the [minimal example](https://github.com/akka/akka-http/blob/v10.5.2/docs/src/test/scala/docs/http/scaladsl/HttpServerRoutingMinimal.scala) listed under “Routing DSL for HTTP servers” within the Akka HTTP documentation, an internal server error (HTTP response code 500) is triggered when an HTTP request is made with an unexpected value in the “Accept-Charset” header. This behavior can be replicated, for instance, using curl as follows:  
`curl http://localhost:8080/hello -H 'Accept-Charset: asd'`  
I tried this in Akka HTTP 10.5.2 and some earlier versions.

Based on the recommendations provided in the [mdm web docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset), I would expect the header to be ignored by default.

The current behavior becomes particularly problematic as malicious actors frequently try to inject code through this header; each attempt appears in my server logs.  
I would appreciate a comment on this. Is there any global configuration option to prevent the header from being evaluated?

---

<div class="post-metadata">

**Author:** ![johanandren](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.akka.io/johanandren/32/85_2.png) [@johanandren](https://discuss.akka.io/u/johanandren)\
**Post date:** [August 15, 2023, 7:10am UTC](https://discuss.akka.io/t/internal-server-error-triggered-by-accept-charset-header-with-unexpected-value/10427/2 "2023-08-15T07:10:28Z")

</div>

Thanks for letting us know, sounds like a bug. The header value is fed to the unmarshallers, which can use the value or ignore it.

I would have expected that passing an invalid value would result in an `UnacceptedResponseContentTypeRejection` in the routing DSL and then turned into a 406 `NotAcceptible` response rather than internal server error (here [RejectionHandler.scala#257](https://github.com/akka/akka-http/blob/main/akka-http/src/main/scala/akka/http/scaladsl/server/RejectionHandler.scala#L257)).

Perhaps it is invalid enough to fail earlier than in the marshalling, and is not handled correctly in the request parsing. Please open up an issue in the akka-http issue tracker ([Issues · akka/akka-http · GitHub](https://github.com/akka/akka-http/issues)) for it.

---

<div class="post-metadata">

**Author:** ![johanandren](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.akka.io/johanandren/32/85_2.png) [@johanandren](https://discuss.akka.io/u/johanandren)\
**Post date:** [August 16, 2023, 8:06am UTC](https://discuss.akka.io/t/internal-server-error-triggered-by-accept-charset-header-with-unexpected-value/10427/3 "2023-08-16T08:06:13Z")

</div>

The issue in case anyone comes looking here: [Internal server error triggered by “Accept-Charset” header with unexpected value · Issue #4295 · akka/akka-http · GitHub](https://github.com/akka/akka-http/issues/4295)