Fails on duplicate Content-Type headers

[jonbarrow]

According to spec, an HTTP message may contain headers with the same name. In those cases the values of the headers are concatenated into a comma separated list https://datatracker.ietf.org/doc/html/rfc9110#section-5.2:

When a field name is repeated within a section, its combined field value consists of the list of corresponding field line values within that section, concatenated in order, with each field line value separated by a comma.

For example, this section:

Example-Field: Foo, Bar
Example-Field: Baz

contains two field lines, both with the field name "Example-Field". The first field line has a field line value of "Foo, Bar", while the second field line value is "Baz". The field value for "Example-Field" is the list "Foo, Bar, Baz".

However type-is fails to accept values when they are concatenated like this. Basic repro (this is using the latest version on npm, 1.6.18, however this still persists on the latest GitHub version 2.0.0):

const typeis = require('type-is');

const type1 = typeis.is('application/x-www-form-urlencoded');
const type2 = typeis.is('application/x-www-form-urlencoded, application/x-www-form-urlencoded');

console.log(type1); // application/x-www-form-urlencoded
console.log(type2); // false

While an uncommon situation, it is one that can happen and is perfectly within the spec. A common way which this may happen is when using Cloudflare Workers/Snippets. If a request comes in and is processed by a Cloudflare Worker/Snippet and contains a duplicate header, Cloudflare will automatically convert this into a comma separated list, and thus fail to be processed here

This issue is not directly caused by type-is, it's actually an upstream issue from other packages which type-is relies on, but I was not sure who should take responsibility for ensuring the header value is split. So I opted to just making multiple issues until a decision is made on that front. Once the other issues are made I'll link to them here

[jonbarrow]

Here are the related issues:

• Fails on HTTP requests with duplicate Content-Type headers expressjs/body-parser#568
• Fails on duplicate Content-Type headers media-typer#17
• Fails on duplicate Content-Type headers content-type#29

[wesleytodd]

I am nearly positive we want to close this issue and deal with it in the source package (I am pretty sure that is content-type but need to dig in to your other issues to be sure). So lets close this so that we dont split the conversation into many places. I will make a similar comment in the others and close all but the one in content-type.