Use dash-separated header session-id instead of session_id

[wengyao04]

What version of Codex is running?

openai/codex current main in v0.101.0.

What issue are you seeing?

The Codex client sends requests to our internal Envoy-based model gateway. Our gateway rejects HTTP headers that contain underscores (_) session_id.

This behavior is intentional on our side and aligns with common HTTP best practices. Underscores in HTTP header names are discouraged due to interoperability issues with common web servers and proxies, which often ignore or drop such headers by default.

As a result, requests from the Codex client fail when underscore-containing headers are present.

Why this matters

While we can relax the validation rule in our gateway, we prefer not to, since:

• It aligns with widely adopted HTTP conventions.
• It avoids subtle interoperability issues across proxies and infrastructure components.
• It maintains consistency with common production hardening practices.

Request

Would it be possible for the Codex client to switch from underscore-separated header names to dash-separated header names (e.g., x-foo-bar instead of x_foo_bar)?

Using dash-separated headers would improve compatibility with common HTTP infrastructure without requiring downstream gateways to weaken validation rules.

[etraut-openai]

This feature request hasn't received enough upvotes, so I'm closing it.

[LeoQuote]

session_id sucks, it causes security issue in history, it does not meet http standard in RFC 9110 Section 16.3.1 it says:

It MUST conform to the field-name syntax defined in Section 5.1, and it SHOULD be restricted to just letters, digits, and hyphen ('-') characters, with the first character being a letter.

Underscore is not listed.

Besides, why would one use x-code-window-id along with session_id? Does this match in style? How many upvotes would you want to do this simple request?

codex/codex-rs/core/src/client.rs

Lines 124 to 131 in b99a62c

	pub const X_CODEX_INSTALLATION_ID_HEADER: &str = "x-codex-installation-id";
	pub const X_CODEX_TURN_STATE_HEADER: &str = "x-codex-turn-state";
	pub const X_CODEX_TURN_METADATA_HEADER: &str = "x-codex-turn-metadata";
	pub const X_CODEX_PARENT_THREAD_ID_HEADER: &str = "x-codex-parent-thread-id";
	pub const X_CODEX_WINDOW_ID_HEADER: &str = "x-codex-window-id";
	pub const X_OPENAI_SUBAGENT_HEADER: &str = "x-openai-subagent";
	pub const X_RESPONSESAPI_INCLUDE_TIMING_METRICS_HEADER: &str =
	"x-responsesapi-include-timing-metrics";