# _fast_h1

URL: /pounce/api/_fast_h1/
Section: api
Description: Fast HTTP/1.1 parser for the sync worker — replaces h11 on the hot path.

Parses request lines and headers directly from bytes using split/index
operations (~3 µs vs ~22 µs for h11) while enforcing the same safety
checks that matter for real-world deployment:

- Method validation (rejects malformed method tokens per RFC 9110)
- Header size limit (prevents memory exhaustion)
- Null byte / control character injection in targets and header names
- Duplicate Content-Length detection (request smuggling vector)
- Duplicate Host detection (request smuggling / routing-desync vector)
- Content-Length + Transfer-Encoding conflict (RFC 7230 §3.3.3)
- Negative or non-numeric Content-Length rejection
- Chunked Transfer-Encoding detection (returns flag so caller can handle)

Not a full HTTP parser — does not handle:
- Chunked body decoding (caller must handle or reject)
- Obs-fold header continuation lines (obsolete since RFC 7230)
- Trailer headers

---

> For a complete page index, fetch /pounce/llms.txt.

Open LLM text
(/pounce/api/_fast_h1/index.txt)

Share with AI

Ask Claude
(https://claude.ai/new?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fpounce%2Fapi%2F_fast_h1%2Findex.txt)

Ask ChatGPT
(https://chatgpt.com/?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fpounce%2Fapi%2F_fast_h1%2Findex.txt)

Ask Gemini
(https://gemini.google.com/app?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fpounce%2Fapi%2F_fast_h1%2Findex.txt)

Ask Copilot
(https://copilot.microsoft.com/?q=Please%20help%20me%20understand%20this%20documentation%3A%20%2Fpounce%2Fapi%2F_fast_h1%2Findex.txt)

Module

#
`_fast_h1`

Fast HTTP/1.1 parser for the sync worker — replaces h11 on the hot path.

Parses request lines and headers directly from bytes using split/index
operations (~3 µs vs ~22 µs for h11) while enforcing the same safety
checks that matter for real-world deployment:

- Method validation (rejects malformed method tokens per RFC 9110)

- Header size limit (prevents memory exhaustion)

- Null byte / control character injection in targets and header names

- Duplicate Content-Length detection (request smuggling vector)

- Duplicate Host detection (request smuggling / routing-desync vector)

- Content-Length + Transfer-Encoding conflict (RFC 7230 §3.3.3)

- Negative or non-numeric Content-Length rejection

- Chunked Transfer-Encoding detection (returns flag so caller can handle)

Not a full HTTP parser — does not handle:

- Chunked body decoding (caller must handle or reject)

- Obs-fold header continuation lines (obsolete since RFC 7230)

- Trailer headers

1Function

## Functions

`parse_request`

4

`tuple[RequestReceived (/pounce/api/protocols/_base/#RequestReceived) | …`

▼

Parse an HTTP request from a buffer.

`def parse_request(buf: memoryview, length: int, *, max_headers: int = 100, max_header_size: int = _MAX_HEADER_SIZE) -> tuple[RequestReceived | None, bytes, int, bool]`

##### Parameters

Name
Type
Description

`buf`
`memoryview`

`length`
`int`

`max_headers`
`int`

Default:`100`

`max_header_size`
`int`

Default:`_MAX_HEADER_SIZE`

##### Returns

`tuple[RequestReceived (/pounce/api/protocols/_base/#RequestReceived) | None, bytes, int, bool]`