That looks way oversimplified. I once wrote a minimal HTTP server in Lua for Nmap project and part of the problem was UTF8 security. Consider get_next_char_len function here to see some of the edge cases:
https://github.com/nmap/nmap/blob/b7a5a6/ncat/scripts/httpd....