HttpContext.Response.Headers setter changes casing of HTTP header

[shravan2x]

Describe the bug

HttpContext.Response.Headers automatically changes casing of certain headers. This issue came up when testing a separate issue with a legacy server where the case of headers mattered. Still I think there should we a way to do this in ASP.

HttpContext.Response.Headers.Add("LOCATIONFY", "/test-redirect?tracker=test"); // retains casing
HttpContext.Response.Headers.Add("LOCATION", "/test-redirect?tracker=test"); // breaks casing to 'Location'

One solution is to add a TryAddWithoutValidation method like there is for HttpClient headers.

To Reproduce

Issue seems simple enough. Can create repro if needed.

Further technical details

• ASP.NET Core version .NET Core 3.1
• Include the output of dotnet --info https://gist.github.com/shravan2x/7454f652cfb579977551f3abd2fdb59a
• The IDE (VS / VS Code/ VS4Mac) you're running on, and it's version VS2019 16.7.1

[davidfowl]

Why does it matter? Did you have a client that treats headers as case sensitive?

[shravan2x]

I was investigating an issue with HttpClient where AllowAutoRedirect didn't work when the header was LOCATION. I tried to repro it to debug further by spinning up an ASP server that returns such headers but wasn't able to because of this issue.

It's definitely not a high-pri request but allows customization to those who need it.

[Tratcher]

Which server were you using? The servers provide their own optimized implementations of HttpContext.Response.Headers. Kestrel for example stores well known headers like Location in dedicated fields. Because of this it discards the given header name string and uses one with the default Location casing when writing to the wire.

Http/1.x header names are explicitly case-insensitive; https://tools.ietf.org/html/rfc7230#section-3.2 "Each header field consists of a case-insensitive field name followed by a colon"

HTTP/2 headers are explicitly lower case.

For these reasons we're unlikely to support case sensitive header names.

[shravan2x]

Which server were you using?

Kestrel.

IMHO there's a use-case for this, so it would be fine to add additional functionality than the RFC specifies. It won't affect people that don't need it but would give power users freedom to customize/test edge cases. Maybe it would be simpler to allow users access to a raw stream to write data to the header block i.e. a HeaderWriter similar to BodyWriter?

[davidfowl]

That absolutely not simpler 😬.

[shravan2x]

I see 🙁.

Well I still think it would be great for ASP to support both power users and the average ones, but you're probably right that adding this is more work than it's worth. I'll close.