Discourse responding to requests with duplicate status headers?

Tsaukpaetra

I just noticed while fudging out the corporate firewall that apparently Discourse seems fit to duplicate the Response Header "status".
Is this just me?

This happens on most types of API requests, except the message bus thing? I've seen it even on static content!

Obviously it's not a breaking issue, but just pondering on things.

Luhmann

502 OK
502 OK

<screw you toaster

PleegWat

Might be a UA bug; the status is normally in the reply line not in a header. I'm pretty sure the same goes for the version.

Granted, it might be that discourse also sends a status header.

AlexMedia

@PleegWat said:

Granted, it might be that discourse also sends a status header.

That's exactly what Discourse does.

ben_lubar

Lowercase headers mean HTTP/2 or one of its precursors.

cheong

It's apparently added by Nginx.

PleegWat

Not necessarily; http 1.1 is case insensitive (though full lower case is not the most common way to represent headers).

Some quick attempts to generate a TCP dump and check that run into SSL. The initial redirect from HTTP to HTTPS does not have those headers, but it may be coming from nginx directly and not from ruby or whatever.

HTTP/1.1 301 Moved Permanently^M
Server: nginx/1.9.4^M
Date: Thu, 24 Dec 2015 13:19:54 GMT^M
Content-Type: text/html^M
Content-Length: 184^M
Connection: keep-alive^M
Location: https://what.thedailywtf.com/^M
^M
<html>^M
<head><title>301 Moved Permanently</title></head>^M
<body bgcolor="white">^M
<center><h1>301 Moved Permanently</h1></center>^M
<hr><center>nginx/1.9.4</center>^M
</body>^M
</html>^M