--- a/grpc.t
+++ b/grpc.t
@@ -24,7 +24,7 @@ select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
 my $t = Test::Nginx->new()->has(qw/http rewrite http_v2 grpc/)
-	->has(qw/upstream_keepalive/)->plan(145);
+	->has(qw/upstream_keepalive/)->plan(146);
 
 $t->write_file_expand('nginx.conf', <<'EOF');
 
@@ -504,6 +504,17 @@ is($frame->{headers}{':status'}, 502, 'i
 ($frame) = grep { $_->{type} eq "HEADERS" } @$frames;
 is($frame->{headers}{':status'}, 502, 'invalid header name ctl');
 
+TODO: {
+local $TODO = 'not yet' unless $t->has_version('1.21.1');
+
+$f->{http_start}('/');
+$f->{data}('Hello');
+$frames = $f->{field_bad}(n => "n n");
+($frame) = grep { $_->{type} eq "HEADERS" } @$frames;
+is($frame->{headers}{':status'}, 502, 'invalid header name space');
+
+}
+
 $f->{http_start}('/');
 $f->{data}('Hello');
 $frames = $f->{field_bad}(v => "v\nv");

--- a/h2_headers.t
+++ b/h2_headers.t
@@ -23,7 +23,7 @@ use Test::Nginx::HTTP2;
 select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
-my $t = Test::Nginx->new()->has(qw/http http_v2 proxy rewrite/)->plan(105)
+my $t = Test::Nginx->new()->has(qw/http http_v2 proxy rewrite/)->plan(107)
 	->write_file_expand('nginx.conf', <<'EOF');
 
 %%TEST_GLOBALS%%
@@ -993,6 +993,35 @@ is($frame->{headers}->{'x-referer'}, 'se
 is($frame->{sid}, $sid, 'colon in header name - RST_STREAM sid');
 is($frame->{code}, 1, 'colon in header name - RST_STREAM code');
 
+TODO: {
+local $TODO = 'not yet' unless $t->has_version('1.21.1');
+
+$s = Test::Nginx::HTTP2->new();
+$sid = $s->new_stream({ headers => [
+	{ name => ':method', value => 'GET', mode => 0 },
+	{ name => ':scheme', value => 'http', mode => 0 },
+	{ name => ':path', value => '/', mode => 0 },
+	{ name => ':authority', value => 'localhost', mode => 1 },
+	{ name => 'x foo', value => "bar", mode => 2 }]});
+$frames = $s->read(all => [{ type => 'RST_STREAM' }]);
+
+($frame) = grep { $_->{type} eq "RST_STREAM" } @$frames;
+ok($frame, 'space in header name - RST_STREAM sid');
+
+$s = Test::Nginx::HTTP2->new();
+$sid = $s->new_stream({ headers => [
+	{ name => ':method', value => 'GET', mode => 0 },
+	{ name => ':scheme', value => 'http', mode => 0 },
+	{ name => ':path', value => '/', mode => 0 },
+	{ name => ':authority', value => 'localhost', mode => 1 },
+	{ name => "foo\x02", value => "bar", mode => 2 }]});
+$frames = $s->read(all => [{ type => 'RST_STREAM' }]);
+
+($frame) = grep { $_->{type} eq "RST_STREAM" } @$frames;
+ok($frame, 'control in header name - RST_STREAM sid');
+
+}
+
 # header name with underscore - underscores_in_headers on
 
 $s = Test::Nginx::HTTP2->new(port(8086));

--- a/ignore_invalid_headers.t
+++ b/ignore_invalid_headers.t
@@ -25,7 +25,7 @@ use Test::Nginx;
 select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
-my $t = Test::Nginx->new()->has(qw/http proxy/)->plan(9)
+my $t = Test::Nginx->new()->has(qw/http proxy/)->plan(12)
 	->write_file_expand('nginx.conf', <<'EOF');
 
 %%TEST_GLOBALS%%
@@ -116,6 +116,24 @@ unlike(get($us2, 8081), qr/x-bar/, 'on -
 like(get($us, 8082), qr/x-bar/, 'underscores_in_headers');
 like(get($us2, 8082), qr/x-bar/, 'underscores_in_headers - first');
 
+# always invalid header characters
+
+my $bad3 = 'GET / HTTP/1.0' . CRLF
+	. ':foo: x-bar' . CRLF . CRLF;
+my $bad4 = 'GET / HTTP/1.0' . CRLF
+	. ' foo: x-bar' . CRLF . CRLF;
+my $bad5 = 'GET / HTTP/1.0' . CRLF
+	. "foo\x02: x-bar" . CRLF . CRLF;
+
+TODO: {
+local $TODO = 'not yet' unless $t->has_version('1.21.1');
+
+like(http($bad3), qr/400 Bad/, 'colon first');
+like(http($bad4), qr/400 Bad/, 'space');
+like(http($bad5), qr/400 Bad/, 'control');
+
+}
+
 ###############################################################################
 
 sub get {