http: do not allow multiple instances of certain response headers

Response headers such as ETag and Last-Modified do not permit
multiple instances, and therefore the comma-separated syntax is
not allowed. When multiple values for these headers are specified,
use only the first instance.

Reviewed-By: Sakthipriyan Vairamani <[email protected]>
Reviewed-By: Ben Noordhuis <[email protected]>
PR-URL: #3090

Author: jasnell

lib/_http_incoming.js

@@ -152,6 +152,12 @@ IncomingMessage.prototype._addHeaderLine = function(field, value, dest) {
     case 'from':
     case 'location':
     case 'max-forwards':
+    case 'retry-after':
+    case 'etag':
+    case 'last-modified':
+    case 'server':
+    case 'age':
+    case 'expires':
       // drop duplicates
       if (dest[field] === undefined)
         dest[field] = value;

test/parallel/test-http-response-multiheaders.js

@@ -0,0 +1,54 @@
+'use strict';
+
+const common = require('../common');
+const http = require('http');
+const assert = require('assert');
+
+// Test that certain response header fields do not repeat
+const norepeat = [
+  'retry-after',
+  'etag',
+  'last-modified',
+  'server',
+  'age',
+  'expires'
+];
+
+const server = http.createServer(function(req, res) {
+  var num = req.headers['x-num'];
+  if (num == 1) {
+    for (let name of norepeat) {
+      res.setHeader(name, ['A', 'B']);
+    }
+    res.setHeader('X-A', ['A', 'B']);
+  } else if (num == 2) {
+    let headers = {};
+    for (let name of norepeat) {
+      headers[name] = ['A', 'B'];
+    }
+    headers['X-A'] = ['A', 'B'];
+    res.writeHead(200, headers);
+  }
+  res.end('ok');
+});
+
+server.listen(common.PORT, common.mustCall(function() {
+  for (let n = 1; n <= 2 ; n++) {
+    // this runs twice, the first time, the server will use
+    // setHeader, the second time it uses writeHead. The
+    // result on the client side should be the same in
+    // either case -- only the first instance of the header
+    // value should be reported for the header fields listed
+    // in the norepeat array.
+    http.get(
+      {port:common.PORT, headers:{'x-num': n}},
+      common.mustCall(function(res) {
+        if (n == 2) server.close();
+        for (let name of norepeat) {
+          assert.equal(res.headers[name], 'A');
+        }
+        assert.equal(res.headers['x-a'], 'A, B');
+      })
+    );
+  }
+}));