Is Flask HTTP header interface case insensitive for both getting and setting?

Question

In my Flask apps, I set and get header values like this:

• response.headers["X-Frame-Options"] = "DENY"
• request.headers.get('X-Forwarded-For', '')

I received an email from Google Cloud saying that it will soon use only lower case header names:

After September 30, HTTP(S) Load Balancers will convert HTTP/1.1 header names to lowercase in the request and response directions

I'm trying to figure out if I need to lower case header names in all my code or if Flask will magically take care of this for me.

Answer 1

Not getting any answers here, I decided to delve into Flask code! Looks like headers are handled in werkzeug and specifically in datastructures.py.

The 'Headers' class is indeed case insensitive when getting headers:

def __getitem__(self, key, _get_mode=False):
    ...
    ikey = key.lower()
    for k, v in self._list:
        if k.lower() == ikey:
            return v
    ...

It appears that the Headers class is not case-insensitive when setting headers and that it sets headers using the exact key that you provide. I suppose this is ok since any code on the receiving end of these headers should follow the standard and treat header names as case insensitive.