Use dash-separated header session-id instead of session_id
What version of Codex is running?
openai/codex current main in v0.101.0.
What issue are you seeing?
The Codex client sends requests to our internal Envoy-based model gateway. Our gateway rejects HTTP headers that contain underscores (_) session_id.
This behavior is intentional on our side and aligns with common HTTP best practices. Underscores in HTTP header names are discouraged due to interoperability issues with common web servers and proxies, which often ignore or drop such headers by default.
As a result, requests from the Codex client fail when underscore-containing headers are present.
Why this matters
While we can relax the validation rule in our gateway, we prefer not to, since:
- It aligns with widely adopted HTTP conventions.
- It avoids subtle interoperability issues across proxies and infrastructure components.
- It maintains consistency with common production hardening practices.
Request
Would it be possible for the Codex client to switch from underscore-separated header names to dash-separated header names (e.g., x-foo-bar instead of x_foo_bar)?
Using dash-separated headers would improve compatibility with common HTTP infrastructure without requiring downstream gateways to weaken validation rules.
3 Comments
This feature request hasn't received enough upvotes, so I'm closing it.
session_idsucks, it causes security issue in history, it does not meet http standard in RFC 9110 Section 16.3.1 it says:It MUST conform to the field-name syntax defined in Section 5.1, and it SHOULD be restricted to just letters, digits, and hyphen ('-') characters, with the first character being a letter.
Underscore is not listed.
Besides, why would one use
x-code-window-idalong withsession_id? Does this match in style? How many upvotes would you want to do this simple request?https://github.com/openai/codex/blob/b99a62c5269d5480fd8b4640fd6689c3393bf957/codex-rs/core/src/client.rs#L124-L131
This was later fixed https://github.com/openai/codex/pull/22193