h3: document that app should validate headers
diff --git a/include/quiche.h b/include/quiche.h
index 378d18a..bf2081d 100644
--- a/include/quiche.h
+++ b/include/quiche.h
@@ -350,9 +350,10 @@
// Iterates over the headers in the event.
//
-// The `cb` callback will be called for each header in `ev`. If `cb` returns
-// any value other than `0`, processing will be interrupted and the value is
-// returned to the caller.
+// The `cb` callback will be called for each header in `ev`. `cb` should check
+// the validity of pseudo-headers and headers. If `cb` returns any value other
+// than `0`, processing will be interrupted and the value is returned to the
+// caller.
int quiche_h3_event_for_each_header(quiche_h3_event *ev,
int (*cb)(uint8_t *name, size_t name_len,
uint8_t *value, size_t value_len,
diff --git a/src/h3/mod.rs b/src/h3/mod.rs
index 3647b61..798cc13 100644
--- a/src/h3/mod.rs
+++ b/src/h3/mod.rs
@@ -495,7 +495,8 @@
pub enum Event {
/// Request/response headers were received.
Headers {
- /// The list of received header fields.
+ /// The list of received header fields. The application should validate
+ /// pseudo-headers and headers.
list: Vec<Header>,
/// Whether data will follow the headers on the stream.
