api_key is not a good example for an HTTP header, because of the underscore #3225
Description
Several HTTP servers strip HTTP headers when they contain _ for security reasons. Using something like api-key instead of api_key in the examples would be a more realistic example.
For references, nginx drops headers with underscores by default ( see https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers or https://dev.to/thesameeric/dont-use-underscores-in-your-http-headers-gfp ) django project's blog ( https://www.djangoproject.com/weblog/2015/jan/13/security/ ) has a good description of the problem. Other servers such as waitress ( Pylons/waitress#80 ) followed by dropping headers with underscore. I think apache http also drop such headers ( https://httpd.apache.org/docs/trunk/en/new_features_2_4.html#:~:text=Header%20names%20containing%20invalid%20characters%20(including%20underscores)%20are%20no%20longer%20converted%20to%20environment%20variables )
What I'm thinking is that in places where api_key is used to give an example of a header, for example in
OpenAPI-Specification/versions/3.1.0.md
Lines 566 to 567 in 2408885
using something like api-key might be better.