Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Are HTTP headers case-sensitive?

In a blog post I use the following PHP to set the content-type of a response:

header('content-type: application/json; charset=utf-8'); 

I just got a comment on that post saying that content-type needs to be capitalized, Content-type. Is this correct? It seems to work for me with all lower-case, and I assumed the HTTP headers were case-insensitive. Or does it just work because browsers are nice?

like image 505
Svish Avatar asked Mar 10 '11 11:03

Svish


People also ask

Are HTTP methods case sensitive?

5.1.The method is case-sensitive. The list of methods allowed by a resource can be specified in an Allow header field (section 14.7).

Why do headers convert into lowercase automatically?

Just as in HTTP/1. x, header field names are strings of ASCII characters that are compared in a case-insensitive fashion. However, header field names MUST be converted to lowercase prior to their encoding in HTTP/2.

Are HTTP headers encrypted?

Yes, headers are encrypted. It's written here. Everything in the HTTPS message is encrypted, including the headers, and the request/response load.

What are headers in HTTP request?

An HTTP header is a field of an HTTP request or response that passes additional context and metadata about the request or response. For example, a request message can use headers to indicate it's preferred media formats, while a response can use header to indicate the media format of the returned body.


2 Answers

HTTP header names are case-insensitive, according to RFC 2616:

4.2:

Each header field consists of a name followed by a colon (":") and the field value. Field names are case-insensitive.

(Field values may or may not be case-sensitive.)

If you trust the major browsers to abide by this, you're all set.


BTW, unlike most of HTTP, methods (verbs) are case sensitive:

5.1.1 Method

The Method token indicates the method to be performed on the
resource identified by the Request-URI. The method is case-sensitive.

   Method         = "OPTIONS"                ; Section 9.2                   | "GET"                    ; Section 9.3                   | "HEAD"                   ; Section 9.4                   | "POST"                   ; Section 9.5                   | "PUT"                    ; Section 9.6                   | "DELETE"                 ; Section 9.7                   | "TRACE"                  ; Section 9.8                   | "CONNECT"                ; Section 9.9                   | extension-method    extension-method = token 
like image 39
Lightness Races in Orbit Avatar answered Sep 22 '22 23:09

Lightness Races in Orbit


Header names are not case sensitive.

From RFC 2616 - "Hypertext Transfer Protocol -- HTTP/1.1", Section 4.2, "Message Headers":

Each header field consists of a name followed by a colon (":") and the field value. Field names are case-insensitive.

The updating RFC 7230 does not list any changes from RFC 2616 at this part.

like image 169
Ignacio Vazquez-Abrams Avatar answered Sep 25 '22 23:09

Ignacio Vazquez-Abrams