Headers allow the same entry multiple times with different case

[diogob003]

HTTP header names are case-insensitive according to the HTTP specification (RFC 2616, RFC 7230).
So "User-Agent" and "user-agent" should be treated as the same key.

I don't know if this is the intended behavior, but okHttp is sending multiple times the same entry.

import okhttp3.OkHttpClient
import okhttp3.Request
import okhttp3.Headers.Companion.toHeaders
import okhttp3.Headers.Companion.headersOf
import okhttp3.mockwebserver.MockResponse
import okhttp3.mockwebserver.MockWebServer

private val client = OkHttpClient()
private val server = MockWebServer()

fun main() {
    val defHeaders = mapOf(
        "User-Agent" to "my-user-agent1",
        "Referer" to "my-referer1"
    )
    server.enqueue(MockResponse())

    println("### Headers from MockWebServer ###")
    val myHeaders = mapOf(
        "user-agent" to "my-user-agent2",
        "User-Agent" to "my-user-agent3",
        "referer" to "my-referer2"
    )
    val request1 = Request.Builder()
        .url(server.url("/"))
        .headers((defHeaders + myHeaders).toHeaders())
        .build()

    client.newCall(request1).execute()

    val recordedRequest = server.takeRequest()
    println(recordedRequest.headers)
    server.close()


    println("### Headers from httpbin ###")
    val request2 = Request.Builder()
        .url("https://httpbin.org/get")
        .headers(headersOf(
            "User-Agent", "my-user-agent1",
            "user-agent", "my-user-agent2",
            "User-Agent", "my-user-agent3",
            "Referer", "my-referer1",
            "referer", "my-referer2",
            "Cookie", "key1=va1",
            "cookie", "key2=val2"))
        .build()

    client.newCall(request2).execute().use { response ->
        println(response.body?.string())
    }
}

Terminal output:

### Headers from MockWebServer ###
User-Agent: my-user-agent1
Referer: my-referer1
user-agent: my-user-agent2
Host: localhost:63575
Connection: Keep-Alive
Accept-Encoding: gzip

### Headers from httpbin ###
{
  "args": {},
  "headers": {
    "Accept-Encoding": "gzip",
    "Cookie": "key1=va1; key2=val2",
    "Host": "httpbin.org",
    "Referer": "my-referer1,my-referer2",
    "User-Agent": "my-user-agent1,my-user-agent2,my-user-agent3,my-user-agent4",
    "X-Amzn-Trace-Id": "Root=########################"
  },
  "origin": "###.###.###.###",
  "url": "https://httpbin.org/get"
}

[yschimke]

Yep, seems like a bug.

https://datatracker.ietf.org/doc/html/rfc7230#section-3.2

A sender MUST NOT generate multiple header fields with the same field
name in a message unless either the entire field value for that
header field is defined as a comma-separated list [i.e., #(values)]
or the header field is a well-known exception (as noted below).

Note: the Map form of manipulating headers is more problematic. You should be able to avoid this using the non map forms.

[swankjesse]

We don't currently model which headers are allowed to repeat. We just treat em all as repeatable and assume application code knows what it's doing.