Headers with the same name are combined into one entry in `http2` #35658

triblondon · 2020-10-15T14:21:54Z

Version: 14.13.1
Platform: macOS, Darwin Kernel Version 19.6.0

What steps will reproduce the bug?

$ node
Welcome to Node.js v14.13.1.
Type ".help" for more information.
> (() => {
...   const http2 = require("http2");
...   const client = http2.connect("https://www.httpbin.org");
...   const req = client.request({ ":path": "/response-headers?foo=42&foo=43&foo=44" });
...   req.on("response", (headers, flags) => console.log("Response:", headers, flags));
...   req.on("end", () => client.close());
...   req.end();
... })();
undefined
> Response: [Object: null prototype] {
  ':status': 200,
  date: 'Thu, 15 Oct 2020 14:15:24 GMT',
  'content-type': 'application/json',
  'content-length': '117',
  server: 'gunicorn/19.9.0',
  foo: '42, 43, 44',
  'access-control-allow-origin': '*',
  'access-control-allow-credentials': 'true'
} 4

Versus cURL on the same URL:

$ curl -i "https://httpbin.org/response-headers?Foo=42&Foo=43&Foo=44"
HTTP/2 200 
date: Thu, 15 Oct 2020 12:58:56 GMT
content-type: application/json
content-length: 117
server: gunicorn/19.9.0
foo: 42
foo: 43
foo: 44
access-control-allow-origin: *
access-control-allow-credentials: true

...body...

How often does it reproduce? Is there a required condition?

Consistently reproducible

What is the expected behavior?

foo: ['42', '43', '44'],

Quoting the docs:

Headers are represented as own-properties on JavaScript objects. The property keys will be serialized to lower-case. Property values should be strings (if they are not they will be coerced to strings) or an Array of strings (in order to send more than one value per header field).

What do you see instead?

foo: '42, 43, 44',

triblondon · 2020-10-15T14:41:16Z

Of course I didn't read enough of the docs. Sigh.

For all other headers, the values are joined together with ', '.

I'd argue this is a bug anyway, because it seems Node can't allow me to distinguish between multiple response headers with the same name, and one header with comma-separated values. This behaviour is also inconsistent with the H1 implementation in Node, which does allow these headers to be identified separately.

But it is behaving as documented.

ZYSzys · 2020-10-22T16:30:40Z

@triblondon It's intentional designed, looking at the rfc 7230 here:

A sender MUST NOT generate multiple header fields with the same field
name in a message unless either the entire field value for that
header field is defined as a comma-separated list [i.e., #(values)]
or the header field is a well-known exception (as noted below).

A recipient MAY combine multiple header fields with the same field
name into one "field-name: field-value" pair, without changing the
semantics of the message, by appending each subsequent field value to
the combined field value in order, separated by a comma.

triblondon · 2020-10-23T10:23:02Z

Being unable to see the wire format is somewhat limiting, though. My use case is a network instrumentation proxy, which is returning not quite accurate representations of the headers it received. And this is available in the h1 implementation.

triblondon mentioned this issue Oct 15, 2020

Headers with same name combine into one entry grantila/fetch-h2#112

Open

watilde added the http2 label Oct 16, 2020

Sep	OCT	Nov
	23
2019	2020	2021

nodejs / node

Headers with the same name are combined into one entry in `http2` #35658

Headers with the same name are combined into one entry in `http2` #35658

triblondon commented Oct 15, 2020 •

edited

triblondon commented Oct 15, 2020 •

edited

ZYSzys commented Oct 22, 2020

triblondon commented Oct 23, 2020 •

edited

nodejs / node

Join GitHub today

Headers with the same name are combined into one entry in `http2` #35658

Headers with the same name are combined into one entry in `http2` #35658

Comments

triblondon commented Oct 15, 2020 • edited

What steps will reproduce the bug?

How often does it reproduce? Is there a required condition?

What is the expected behavior?

What do you see instead?

triblondon commented Oct 15, 2020 • edited

ZYSzys commented Oct 22, 2020

triblondon commented Oct 23, 2020 • edited

Essential cookies

Always active

Analytics cookies

triblondon commented Oct 15, 2020 •

edited

triblondon commented Oct 15, 2020 •

edited

triblondon commented Oct 23, 2020 •

edited