net/http: allow control of case of header key #5022

gopherbot · 2013-03-10T04:52:29Z

http.Header.Add() changes the case of the given header key, which causes
problems. See: http://play.golang.org/p/ci5_qeAYRh

I'm on MacOS X 10.8.2 using Go 1.0.3, but this issue applies to all platforms
and current versions of Go.

I understand that this was done intentionally. The comment above the
http.Request.Header declaration says:

    // HTTP defines that header names are case-insensitive.
    // The request parser implements this by canonicalizing the
    // name, making the first character and any characters
    // following a hyphen uppercase and the rest lowercase.

It's likely referring to section 3.4.7 of RFC 822, which says:

    When matching any other syntactic unit, case is to be ignored.
    For  example, the field-names "From", "FROM", "from", and even
    "FroM" are semantically equal and should all be treated ident-
    ically.

    When generating these units, any mix of upper and  lower  case
    alphabetic  characters  may  be  used.  The case shown in this
    specification is suggested for message-creating processes.

In an ideal world, all servers / remote APIs would respect this guideline when
parsing and handling HTTP headers. However, they don't, which can cause grief
for users of the http package. I spent a fair amount of time myself trying to
figure out why a particular API endpoint wasn't finding and accepting my
authentication header.

It's for this reason that I believe that http.Header.Add() should not change
header key casing *because* the RFC says that casing isn't important. If casing
isn't important, there's no reason to change it, anyways, and users can ensure
that their headers will be handled properly in cases when the remote service
doesn't respect the guideline.

bradfitz · 2013-03-11T14:06:10Z

Comment 1:

This is the first report I've seen in 2+ years of issues with this design.  It's
impractical to change at this point.
Maybe we could provide some way for you to white-list certain header keys, or to provide
your own WriteRequest function to the Transport.
But that will have to wait until after Go 1.1.

Labels changed: removed priority-triage.

Status changed to Thinking.

rsc · 2013-03-11T15:15:57Z

Comment 2:

What API endpoint are we talking about? You should also a file a bug with them, since
they have a broken HTTP server.

rsc · 2013-03-11T15:16:47Z

Comment 4:

Also, can't you just do
header["yourKey"] = whatever
and bypass Add?

bradfitz · 2013-03-11T18:04:13Z

Comment 5:

Re: #4, indeed. I forgot that worked. (I thought WriteHeader did the canonicalization) 
I added a test in https://golang.org/cl/7712043 to verify we don't break that
going forward.
Then I'll close this.

Owner changed to @bradfitz.

Status changed to Started.

bradfitz · 2013-03-11T18:10:52Z

Comment 6:

This issue was closed by revision f0396ca.

Status changed to Fixed.

gopherbot · 2013-03-11T18:13:42Z

Comment 7 by tyson@stovepipestudios.com:

Works for me -- thanks!

gopherbot · 2014-05-13T18:07:53Z

Comment 8 by dan@ezoic.com:

Example where case is important:  In mod_pagespeed, the header "PageSpeed" to enable or
disable the module for a specific request, is case sensitive.  Two google products not
working nicely together.  :)
In a broader way, if the app is acting like a proxy and the headers are not used
directly by the app but rather passed thru to two other http servers, it may matter.

bradfitz · 2014-05-13T18:14:41Z

Comment 9:

Please move this discussion to the mailing list.

marcosnils · 2014-12-08T22:00:31Z

@bradfitz This also happens when you write a response Header from the server side perspective. Here's an example: http://play.golang.org/p/o37Js5lb8f

Are you planning to make this change also for response headers?. Should I open another issue?

Thanks

minux · 2014-12-09T02:23:39Z

this issue has been closed, please file a new one. Thanks.

bradfitz · 2014-12-09T02:27:25Z

It's closed but I'll reply again for the record, to unify conversations that have happened in several places:

We won't be changing this. HTTP/2 doesn't even have case in headers.

If you have an application that cares, it's broken, has always been broken, and needs to be fixed sooner than later.

marcosnils · 2014-12-09T02:29:05Z

Perfect @bradfitz. I do also agree with you that applications should comply with the specs, but as you know that usually doesn't happen 😄.

Thanks for the response.

elgs · 2016-02-19T14:40:11Z

I have an http server application reading header like this:

r.Header.Get("some_header")

In go1.4.2, the code worked well. However, after upgrading to go1.5 and go1.6, the header was magically changed to Some_header. It's really annoying.

elgs · 2016-02-19T15:17:48Z

Now I have to change my code everywhere to be like this in order to be compatible with old versions:

apiTokenId := r.Header.Get("api_token_id")
if apiTokenId == "" {
    apiTokenId = r.Header.Get("Api_token_id")
}

I don't understand why the library should manipulate the header key, as if I don't know what I am doing.

marcosnils · 2016-02-19T15:25:24Z

@elgs just wrap your r.Header.Get around a lowercase and that's it. No need to call Get twice.

elgs · 2016-02-19T15:35:21Z

@marcosnils thanks, but I don't understand what you meant by wrapping my r.Header.Get around a lowercase. The client puts api_token_id as the header key. On the server side, when I do fmt.Println(r.Header), the shows Api_token_id.

minux · 2016-02-19T15:38:36Z

Because Header.Get already handles CanonicalHeaderKey transformations for you. This issue has already been closed for some time, please ask questions elsewhere (see https://golang.org/wiki/Questions)

elgs · 2016-02-19T15:44:47Z

@minux I don't mind talking a bit more here as here is the perfect context for this question. I think CanonicalHeaderKey is a bit too smart and does nothing but causing confusions.

minux · 2016-02-19T16:11:56Z

HTTP headers are case insensitive, and net/http.Header is a map, so there has to be a canonical case mapping somewhere. And Header.Get already handles all these for you. We don't do discussions on closed issues, so please ask questions on the mailing list. Thanks.

elgs · 2016-02-19T16:19:04Z

Aha! OK, that makes sense to me. Thanks @minux.

gopherbot added the fixed label May 13, 2014

gopherbot assigned bradfitz May 13, 2014

davecheney mentioned this issue Feb 7, 2015

bootstrap: segmentation fault during build #9800

Closed

j16sdiz mentioned this issue Oct 5, 2015

Case Sensitive Header franela/goreq#106

Closed

djannot mentioned this issue Feb 19, 2016

CopyHeaders is using http.Header.Add() that capitalizes the headers vulcand/oxy#30

Open

djannot added a commit to djannot/oxy that referenced this issue Feb 19, 2016

See golang/go#5022

eeaa5fd

emilevauge mentioned this issue Jun 17, 2016

HTTP headers case gets modified traefik/traefik#466

Closed

nl5887 mentioned this issue Jul 18, 2016

Validate and support elasticsearch s3 plugin minio/minio#2217

Closed

mholt mentioned this issue Aug 21, 2016

Header name auto-titlecasing breaks some applications caddyserver/caddy#1057

Closed

bradfitz mentioned this issue Jan 2, 2017

net/http: CanonicalHeaderKey capitalization is non-conformant with RFC 6455 #18495

Closed

njsmith mentioned this issue Feb 20, 2017

Discussion: Capitalize the header names of outgoing headers. python-hyper/h11#31

Closed

golang locked and limited conversation to collaborators Feb 28, 2017

gopherbot added the FrozenDueToAge label Feb 28, 2017

rsc unassigned bradfitz Jun 22, 2022

This issue was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

net/http: allow control of case of header key #5022

net/http: allow control of case of header key #5022

gopherbot commented Mar 10, 2013

bradfitz commented Mar 11, 2013

rsc commented Mar 11, 2013

rsc commented Mar 11, 2013

bradfitz commented Mar 11, 2013

bradfitz commented Mar 11, 2013

gopherbot commented Mar 11, 2013

gopherbot commented May 13, 2014

bradfitz commented May 13, 2014

marcosnils commented Dec 8, 2014

minux commented Dec 9, 2014

bradfitz commented Dec 9, 2014

marcosnils commented Dec 9, 2014

elgs commented Feb 19, 2016

elgs commented Feb 19, 2016

marcosnils commented Feb 19, 2016

elgs commented Feb 19, 2016

minux commented Feb 19, 2016 via email

elgs commented Feb 19, 2016

minux commented Feb 19, 2016 via email

elgs commented Feb 19, 2016

net/http: allow control of case of header key #5022

net/http: allow control of case of header key #5022

Comments

gopherbot commented Mar 10, 2013

bradfitz commented Mar 11, 2013

rsc commented Mar 11, 2013

rsc commented Mar 11, 2013

bradfitz commented Mar 11, 2013

bradfitz commented Mar 11, 2013

gopherbot commented Mar 11, 2013

gopherbot commented May 13, 2014

bradfitz commented May 13, 2014

marcosnils commented Dec 8, 2014

minux commented Dec 9, 2014

bradfitz commented Dec 9, 2014

marcosnils commented Dec 9, 2014

elgs commented Feb 19, 2016

elgs commented Feb 19, 2016

marcosnils commented Feb 19, 2016

elgs commented Feb 19, 2016

minux commented Feb 19, 2016 via email

elgs commented Feb 19, 2016

minux commented Feb 19, 2016 via email

elgs commented Feb 19, 2016