Szorc: Mercurial's Journey to and Reflections on Python 3

For a real-world example of handling HTTP headers, see XMLHttpRequest.getResponseHeader(). That's defined to return a ByteString (https://xhr.spec.whatwg.org/#ref-for-dom-xmlhttprequest-g...), which is converted to a JavaScript String by effectively decoding as Latin-1 (i.e. each byte is translated directly into a single 16-bit JS character) (https://heycam.github.io/webidl/#es-ByteString). When setting a header, you should get a TypeError exception if the JS String contains any character above U+00FF.

The only restrictions on a header value (https://fetch.spec.whatwg.org/#concept-header-value) are that it can't contain 0x00, 0x0D or 0x0A, and can't have leading/trailing 0x20 or 0x09. (And browsers only agreed on rejecting 0x00 quite recently.)

So it's pretty much just bytes, and if you want to try interpreting it as Unicode then that's at your own risk.