-
Notifications
You must be signed in to change notification settings - Fork 844
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Test end-to-end multi-value header support #155
Comments
#437 is a good example of how this can break. |
Another example: |
samsp-msft
added
the
samsp_list
Personal tag used when reviewing issues for further discussion
label
Dec 9, 2021
Tagging as its the kind of thing that will cause problems for one of our services. |
karelz
removed
the
samsp_list
Personal tag used when reviewing issues for further discussion
label
Dec 16, 2021
1 task
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
In theory the HTTP spec allows any multi-value headers to be represented as a single comma separated list or as multiple
key: value
headers. In practice there are at least two headers that break clients if merged to a single line, Set-Cookie and WWW-Authenticate.Test the end-to-end experience for multi-value request and response headers, especially Set-Cookie and WWW-Authenticate. A header's format should be maintained as much as possible in either direction. E.g. don't split up a comma separated list into multiple headers, and don't combine multiple headers into a comma separated list.
There are known issues with Http.Sys and IIS data structures combining multi-value request headers.
The text was updated successfully, but these errors were encountered: