InvalidRequest: 400 Bad Request: invalid header value

[lvrfrc87]

python 3.7 - client.read return 400 bad request.

>>> import os
>>> import hvac
>>> vault_client = hvac.Client(url='http:https://localhost:8200',token=os.environ['VAULT_TOKEN'])
>>>
>>>
>>>
>>> vault_point = vault_client.read('secret/db')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.7/site-packages/hvac/v1/__init__.py", line 195, in read
    return self._adapter.get('/v1/{0}'.format(path), wrap_ttl=wrap_ttl).json()
  File "/usr/local/lib/python3.7/site-packages/hvac/adapters.py", line 93, in get
    return self.request('get', url, **kwargs)
  File "/usr/local/lib/python3.7/site-packages/hvac/adapters.py", line 265, in request
    utils.raise_for_error(response.status_code, text, errors=errors)
  File "/usr/local/lib/python3.7/site-packages/hvac/utils.py", line 29, in raise_for_error
    raise exceptions.InvalidRequest(message, errors=errors)
hvac.exceptions.InvalidRequest: 400 Bad Request: invalid header value

 vault read -address=${VAULT_ADDR} secret/db
Key                 Value
---                 -----
refresh_interval    768h
password            supersecretpassword
user                root

[jeffwecan]

I'm unable to replicate with a fresh dev vault server:

$ ipython
Python 3.7.1 (default, Nov  6 2018, 18:45:35)
Type 'copyright', 'credits' or 'license' for more information
IPython 7.1.1 -- An enhanced Interactive Python. Type '?' for help.

In [1]: import os

In [2]: import hvac

In [3]: vault_client = hvac.Client(url='http:https://localhost:8200',token=os.environ['VAULT_TOKEN'])

In [4]: vault_point = vault_client.read('secret/db')

In [5]: print(vault_point)
None

Are there any other replication steps you can think of that would help trigger the same exceptional case?

[laviua]

it's connected with the fact, that native python http client has a validation by regexp:
_is_illegal_header_value = re.compile(rb'\n(?![ \t])|\r(?![ \t\n])').search
take a look that your token doesn't have any escape sequences like this: \n or \r in the end of your line

[davidmontoyago]

This could happen if the vault token value has been accidentally set with a line break.