The checking on HTTP field values in QWebSocketPrivate::createHandshakeRequest() is too optimistic. It only checks if the value contains a '\r\n' sequence. This is not sufficient. The HTTP standard defines more illegal characters.