http: generic join header

nodejs-github-bot · Jan 3, 2023 · Dec 26, 2022 · Dec 26, 2022 · Dec 28, 2022 · Dec 28, 2022
commit fdc2c0012b2f6717bed05d2142573c8de650938c
diff --git a/doc/api/http.md b/doc/api/http.md
@@ -2451,11 +2451,12 @@ header name:
   `etag`, `expires`, `from`, `host`, `if-modified-since`, `if-unmodified-since`,
   `last-modified`, `location`, `max-forwards`, `proxy-authorization`, `referer`,
   `retry-after`, `server`, or `user-agent` are discarded.
+  To allow duplicate values of the headers listed above to be joined,
+  use the option `joinDuplicateHeaders` in [`http.request()`][]
+  and [`http.createServer()`][].
 * `set-cookie` is always an array. Duplicates are added to the array.
 * For duplicate `cookie` headers, the values are joined together with `; `.
 * For all other headers, the values are joined together with `, `.
-* To allow duplicate values of `authorization` see the option
-  `joinAuthorizationHeaders` in [`http.request()`][]
 
 ### `message.headersDistinct`
 
@@ -3184,9 +3185,9 @@ changes:
     a 400 (Bad Request) status code to any HTTP/1.1 request message
     that lacks a Host header (as mandated by the specification).
     **Default:** `true`.
-  * `joinAuthorizationHeaders` {boolean} It joins the field line values of
-    multiple `Authorization` headers in a request
-    with ` ,` instead of discarding the duplicates.
+  * `joinDuplicateHeaders` {boolean} It joins the field line values of multiple
+    headers in a request with ` ,` instead of discarding the duplicates.
+    See [`message.headers`][] for more information.
     **Default:** `false`.
   * `ServerResponse` {http.ServerResponse} Specifies the `ServerResponse` class
     to be used. Useful for extending the original `ServerResponse`. **Default:**
@@ -3443,9 +3444,9 @@ changes:
   * `uniqueHeaders` {Array} A list of request headers that should be sent
     only once. If the header's value is an array, the items will be joined
     using `; `.
-  * `joinAuthorizationHeaders` {boolean} It joins the field line values of
-    multiple `Authorization` headers in a request
-    with ` ,` instead of discarding the duplicates.
+  * `joinDuplicateHeaders` {boolean} It joins the field line values of
+    multiple headers in a request with ` ,` instead of discarding
+    the duplicates. See [`message.headers`][] for more information.
 * `callback` {Function}
 * Returns: {http.ClientRequest}
 
@@ -3759,6 +3760,7 @@ Set the maximum number of idle HTTP parsers. **Default:** `1000`.
 [`http.IncomingMessage`]: #class-httpincomingmessage
 [`http.ServerResponse`]: #class-httpserverresponse
 [`http.Server`]: #class-httpserver
+[`http.createServer()`]: #httpcreateserveroptions-requestlistener
 [`http.get()`]: #httpgetoptions-callback
 [`http.globalAgent`]: #httpglobalagent
 [`http.request()`]: #httprequestoptions-callback

diff --git a/lib/_http_client.js b/lib/_http_client.js
@@ -229,11 +229,11 @@ function ClientRequest(input, options, cb) {
   }
   this.insecureHTTPParser = insecureHTTPParser;
 
-  if (options.joinAuthorizationHeaders !== undefined) {
-    validateBoolean(options.joinAuthorizationHeaders, 'options.joinAuthorizationHeaders');
+  if (options.joinDuplicateHeaders !== undefined) {
+    validateBoolean(options.joinDuplicateHeaders, 'options.joinDuplicateHeaders');
   }
 
-  this.joinAuthorizationHeaders = options.joinAuthorizationHeaders;
+  this.joinDuplicateHeaders = options.joinDuplicateHeaders;
 
   this.path = options.path || '/';
   if (cb) {
@@ -817,7 +817,7 @@ function tickOnSocket(req, socket) {
     parser.maxHeaderPairs = req.maxHeadersCount << 1;
   }
 
-  parser.joinAuthorizationHeaders = req.joinAuthorizationHeaders;
+  parser.joinDuplicateHeaders = req.joinDuplicateHeaders;
 
   parser.onIncoming = parserOnIncomingClient;
   socket.on('error', socketErrorListener);

diff --git a/lib/_http_common.js b/lib/_http_common.js
@@ -94,9 +94,9 @@ function parserOnHeadersComplete(versionMajor, versionMinor, headers, method,
   incoming.httpVersionMajor = versionMajor;
   incoming.httpVersionMinor = versionMinor;
   incoming.httpVersion = `${versionMajor}.${versionMinor}`;
-  incoming.joinAuthorizationHeaders = (socket && socket.server &&
-                                       socket.server.joinAuthorizationHeaders) ||
-                                       parser.joinAuthorizationHeaders;
+  incoming.joinDuplicateHeaders = (socket && socket.server &&
+                                       socket.server.joinDuplicateHeaders) ||
+                                       parser.joinDuplicateHeaders;
   incoming.url = url;
   incoming.upgrade = upgrade;
 

diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
@@ -75,7 +75,7 @@ function IncomingMessage(socket) {
   this[kTrailers] = null;
   this[kTrailersCount] = 0;
   this.rawTrailers = [];
-  this.joinAuthorizationHeaders = false;
+  this.joinDuplicateHeaders = false;
   this.aborted = false;
 
   this.upgrade = null;
@@ -399,7 +399,7 @@ function _addHeaderLine(field, value, dest) {
     } else {
       dest['set-cookie'] = [value];
     }
-  } else if (this.joinAuthorizationHeaders && flag === 97) {
+  } else if (this.joinDuplicateHeaders) {
     // RFC 9110 https://www.rfc-editor.org/rfc/rfc9110#section-5.2
     // https://github.com/nodejs/node/issues/45699
     // allow authorization multiple fields

diff --git a/lib/_http_server.js b/lib/_http_server.js
@@ -482,11 +482,11 @@ function storeHTTPOptions(options) {
     this.requireHostHeader = true;
   }
 
-  const joinAuthorizationHeaders = options.joinAuthorizationHeaders;
-  if (joinAuthorizationHeaders !== undefined) {
-    validateBoolean(joinAuthorizationHeaders, 'options.joinAuthorizationHeaders');
+  const joinDuplicateHeaders = options.joinDuplicateHeaders;
+  if (joinDuplicateHeaders !== undefined) {
+    validateBoolean(joinDuplicateHeaders, 'options.joinDuplicateHeaders');
   }
-  this.joinAuthorizationHeaders = joinAuthorizationHeaders;
+  this.joinDuplicateHeaders = joinDuplicateHeaders;
 }
 
 function setupConnectionsTracking(server) {

diff --git a/lib/http.js b/lib/http.js
@@ -53,7 +53,7 @@ let maxHeaderSize;
  *   insecureHTTPParser?: boolean;
  *   maxHeaderSize?: number;
  *   requireHostHeader?: boolean;
- *   joinAuthorizationHeaders?: boolean;
+ *   joinDuplicateHeaders?: boolean;
  *   }} [opts]
  * @param {Function} [requestListener]
  * @returns {Server}

diff --git a/test/parallel/test-http-request-join-authorization-headers.js b/test/parallel/test-http-request-join-authorization-headers.js
@@ -6,7 +6,7 @@ const http = require('http');
 {
   const server = http.createServer({
     requireHostHeader: false,
-    joinAuthorizationHeaders: true
+    joinDuplicateHeaders: true
   }, common.mustCall((req, res) => {
     assert.strictEqual(req.headers.authorization, '1, 2');
     res.writeHead(200, ['authorization', '3', 'authorization', '4']);
@@ -17,7 +17,7 @@ const http = require('http');
     http.get({
       port: server.address().port,
       headers: ['authorization', '1', 'authorization', '2'],
-      joinAuthorizationHeaders: true
+      joinDuplicateHeaders: true
     }, (res) => {
       assert.strictEqual(res.statusCode, 200);
       assert.strictEqual(res.headers.authorization, '3, 4');