🐛 fix: match HTTP field names the way a recipient must

[gaby]

Description

2 of 3, split out of #4581. Based on #4584 — review that one first, or read this diff against claude/split-1-url-composition.

Field names are case-insensitive (RFC 9110 §5.1), but fasthttp's Peek, PeekAll and Del compare the stored key byte for byte. That is enough while fasthttp canonicalizes it — under DisableHeaderNormalizing the store keeps the spelling the client sent, and lower case is what HTTP/2 and HTTP/3 put on the wire, so it is what a front end translating down to HTTP/1.1 preserves. Every guard below was then reading a header that was there as if it were absent.

Measured, with DisableHeaderNormalizing set:

Peek("Authorization") = ""            stored key: "authorization"
Peek("Content-Type")  = "text/plain"  <- special slot, works either way

That last line is why this survived review: the names fasthttp keeps in a slot of their own still resolve, so a spot check on the obvious header passes.

What was wrong

cache

An anonymous request was served another user's authenticated page. A lower-case authorization: read as no credential at all, so the response was stored as anonymous and replayed to everyone — bearer token included. Set-Cookie2, Vary and KeyHeaders missed the same way, storing and replaying a personalized response and dropping a Vary dimension silently out of the key. public was injected into a response that never said it — exactly the token that lifts RFC 9111 §3.5 for a response to an authenticated request.

Unrelated to case, in the same paths: a cached 3xx lost its Location, so the first client got 301 Location: /new and every one after a bare 301; a Set-Cookie on a shared entry handed one client's session to everyone matching the key; and a repeated header name was collapsed on replay, so a response sending Vary twice came back varying only on the second.

proxy

Every sanitizer removed nothing. A cross-host redirect carried the caller's authorization: and cookie: to the redirect target; upgrade, te, keep-alive and a connection:-listed header reached the upstream; and the client's own x-real-ip arrived beside the one the proxy writes, so the upstream attributed the request to an address the client chose.

The response strip also asked the wrong object: a proxied response is parsed by the outbound fasthttp.Client, which carries its own setting and stamps it onto that header each hop. A proxy preserving upstream casing in front of a normalizing app stripped nothing.

csrf

The origin check was switched off by the case of a header name. With a valid double-submit pair, Origin: http://evil.com → 403, but origin: http://evil.com → 200. An absent Origin is not a failure there — on a plaintext connection the check is skipped for it entirely.

others

• extractors.FromHeader: a token sent under the lower-case name was not found, and the request refused for carrying no token when it carried one.
• logger: ${ips} logged an empty chain while the trust decisions went on using the header it could not see; RegisterContextTag wrote its value raw, where a CR or LF forged a log line.
• adaptor: a wrapped net/http middleware's header edits were lost — a Header.Set collapsing a multi-valued header left the other values in place, a middleware that changed nothing duplicated the last value of every multi-valued header, and removals never propagated at all.
• form parsing: fasthttp matches the media type and boundary= case-sensitively, so a legal Multipart/Form-Data bound nothing and reported no error.
• Scheme(): only http and https are accepted from a proxy header. The value is spliced into a URL by BaseURL and compared for origin equality by csrf and Redirect().Back, so no other scheme — javascript included — may become the request's.

basicauth and cors were checked too and fail closed — a lower-case name locks a legitimate client out, never lets one in — so they are left alone and the finding is recorded rather than acted on.

Changes introduced

• Benchmarks: two measurements changed the design rather than confirming it. The first delField cost 792 B/op and ran 3× slower on the proxy's default path (a range-over-func iterator allocation per name), so the normalization answer is threaded from config instead — measured back to 0 B/op and the original ns/op. An earlier header dedup in adaptor was 17% slower at 20 headers and 61% at 100, so it was removed.
• Documentation Update: docs/middleware/cache.md, docs/middleware/proxy.md (an X-Real-IP caution and a two-pass snippet), docs/middleware/logger.md (${ips}), docs/api/ctx.md, docs/extra/internal.md.
• Changelog/What's New: not written yet.
• Migration Guide: not needed — see below.
• API Alignment with Express: no API surface changes.
• API Longevity: no signature changes to exported APIs. Four internal/ packages hold the shared primitives so the duplication that caused one of these cannot cause the next: fieldname (case-insensitive read and delete over fasthttp header types), headerlookup (the same for a caller holding a Ctx), mediatype (the Content-Type fold every form entry point needs) and crosshost (the credential list the client and proxy had already let drift apart).
• Examples: covered by the tests rather than separately.

Behavior changes worth knowing about

• A response that sets a cookie is no longer stored by the cache unless it opts in with public or s-maxage. Applications that refresh a session cookie on every response will find most routes stop being cached — that is the point, since those responses are per-client. must-revalidate does not lift this: RFC 9111 §3.5 accepts it for Authorization because a revalidating cache re-checks the credential at the origin, and this middleware never revalidates.
• A proxy header naming a scheme other than http/https no longer becomes the request's scheme; the previously determined one stands.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• Documentation update (changes to documentation)
• Code consistency (non-breaking change which improves code reliability and robustness)

Checklist

• Followed the inspiration of the Express.js framework for new functionalities, making them similar in usage.
• Conducted a self-review of the code and provided comments for complex or critical parts.
• Updated the documentation in the /docs/ directory for Fiber's documentation.
• Added or updated unit tests to validate the effectiveness of the changes or new features.
• Ensured that new and existing unit tests pass locally with the changes.
• Verified that any new dependencies are essential and have been agreed upon by the maintainers/community. (no new module dependencies; four new internal/ packages)
• Aimed for optimal performance with minimal allocations in the new code.
• Provided benchmarks for the new code to analyze and improve upon.

Verification

go build ./..., go vet ./..., go test ./..., gofmt -l . and golangci-lint v2.12.2 (the version .github/workflows/lint.yml pins) — 0 issues — all run on this branch.

Every fix is mutation-verified: reproduced with a probe first, then the fix reverted in a scratch copy, the new test confirmed failing, then restored.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (3)

• master
• v2
• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8eec917b-910b-4007-9963-841830130303

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The PR adds shared case-insensitive header and media-type utilities. It updates form parsing, caching, proxy filtering, middleware synchronization, CSRF checks, logging, scheme validation, and related documentation and tests.

Changes

Header normalization and request processing

Layer / File(s)	Summary
Media-type normalization and form binding internal/mediatype/*, binder/*, bind.go, helpers.go, req.go, redirect.go	Form media types and parameter names are normalized while multipart boundary values remain unchanged.
Header lookup and middleware synchronization internal/fieldname/*, internal/headerlookup/*, middleware/adaptor/*, extractors/*	Header access, deletion, extraction, and middleware synchronization now support non-canonical field names and repeated values.
Cache key and response handling middleware/cache/*	Cache keys include all header field lines. Cached responses replace stale header spellings, exclude cookie headers, preserve repeated fields, and retain redirect locations.
Proxy filtering and redirects middleware/proxy/*, internal/crosshost/*	Proxy forwarding replaces all client-supplied X-Real-IP fields, strips hop-by-hop headers case-insensitively, and removes sensitive headers across cross-host redirects.
Security and logging consumers middleware/csrf/*, middleware/logger/*	CSRF header reads use case-insensitive lookup. IP logging uses the parsed proxy chain and sanitizes output.
Documentation and regression coverage docs/*, ctx_test.go, related tests	Documentation records content-type mutation, scheme restrictions, cache behavior, proxy header handling, logger behavior, and flash-cookie properties.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

• gofiber/fiber#4405: Related proxy redirect, scheme validation, and case-insensitive header handling.
• gofiber/fiber#4570: Related form content-type normalization changes.
• gofiber/fiber#4581: Overlapping form normalization and media-type utility changes.

Suggested labels: v3

Suggested reviewers: efectn, sixcolors, renewerner87

Poem

I nibbled the headers, both lowercase and bright,
Bound forms through boundaries, preserved values just right.
Cache keys grew careful, proxies shed stale disguise,
Logs kept their newlines safely out of sight.
Hop, hop—the rabbit approves this rewrite!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 79.87% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary fix for case-insensitive HTTP field-name handling.
Description check	✅ Passed	The description is detailed and covers the problem, changes, behavior impacts, tests, documentation, benchmarks, and verification.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/split-2-header-matching

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 96.06742% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.69%. Comparing base (e98ccd8) to head (ef43f3f).

Files with missing lines	Patch %	Lines
client/transport.go	91.93%	3 Missing and 2 partials ⚠️
middleware/cache/cache.go	93.93%	2 Missing and 2 partials ⚠️
client/cookiejar.go	75.00%	1 Missing and 2 partials ⚠️
middleware/cache/keygen.go	86.36%	2 Missing and 1 partial ⚠️
middleware/cache/utils.go	95.94%	2 Missing and 1 partial ⚠️
req.go	89.47%	2 Missing ⚠️
middleware/logger/context_tag.go	50.00%	1 Missing ⚠️

Additional details and impacted files

@@                        Coverage Diff                         @@
##           claude/split-1-url-composition    #4585      +/-   ##
==================================================================
+ Coverage                           93.58%   93.69%   +0.11%     
==================================================================
  Files                                 140      140              
  Lines                               15605    15978     +373     
==================================================================
+ Hits                                14604    14971     +367     
+ Misses                                627      624       -3     
- Partials                              374      383       +9     

Flag	Coverage Δ
unittests	93.69% <96.06%> (+0.11%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gaby]

@coderabbitai review

Auto-review is off for this one because the base is claude/split-1-url-composition (#4584) rather than main — this is 2 of 3 in a chained split of #4581, so it has to stay stacked until #4584 merges. Requesting a review explicitly so this doesn't go unreviewed in the meantime; it carries the largest share of the security fixes.

Note the branch was force-pushed once, rebasing onto #4584's new tip after a documentation fix there. No code changed in the rebase.

---

Generated by Claude Code

[coderabbitai]

@gaby I will review pull request #4585 against its stacked base, #4584.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 417636b676

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (4)

middleware/adaptor/adaptor_test.go (1)

2300-2377: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add coverage for a request with header normalization disabled.

Every subtest uses fiber.New(), which keeps fasthttp header normalization enabled, and every header name is already canonical. The new isFramingHeader and clearCopiedHeaders logic exists to survive non-canonical storage, so that path stays untested here.

Add a subtest that builds the app with fiber.New(fiber.Config{DisableHeaderNormalizing: true}) and sends a lowercase content-length and a lowercase x-forwarded-for. That case proves clearCopiedHeaders skips framing fields by fold-equality and that Del matches the raw stored spelling.

I can write this subtest if you want it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@middleware/adaptor/adaptor_test.go` around lines 2300 - 2377, Add a subtest
to Test_HTTPMiddleware_HeaderFidelity using
fiber.New(fiber.Config{DisableHeaderNormalizing: true}) and lowercase
content-length and x-forwarded-for request headers. Exercise the existing
middleware flow and assert framing headers remain correctly handled while the
lowercase forwarded-for value is preserved or replaced through
raw-spelling-aware deletion. Keep the test focused on clearCopiedHeaders and
isFramingHeader behavior without changing the existing canonical-header
subtests.

docs/middleware/cache.md (1)

127-211: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Run the Markdown lint task for these new sections.

The repository requires make markdown after Markdown changes. The added sections are long and contain hard-wrapped prose plus a fenced Go block, which are common lint targets.

As per coding guidelines: "**/*.md: Run make markdown to lint all Markdown files when modifying code".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/middleware/cache.md` around lines 127 - 211, Run the repository’s
Markdown lint task with make markdown after updating the new sections in the
cache middleware documentation, then fix any reported formatting issues in the
hard-wrapped prose or fenced Go example.

Source: Coding guidelines

middleware/cache/cache.go (1)

770-780: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Remove the always-true v >= 0 check.

fasthttp.ParseUint returns a non-negative int when err == nil. The inner condition never fails, so it only adds a branch.

♻️ Proposed simplification

 		if b := fieldname.First(&c.Response().Header, fiber.HeaderAge, canonical); len(b) > 0 {
 			if v, err := fasthttp.ParseUint(b); err == nil {
-				if v >= 0 {
-					ageVal = uint64(v)
-				}
+				ageVal = uint64(v)
 			}
 		} else {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@middleware/cache/cache.go` around lines 770 - 780, Remove the redundant v >=
0 condition in the ageVal assignment within the response-header age parsing
logic; when fasthttp.ParseUint succeeds, assign v directly to ageVal, while
preserving the existing error handling and default header behavior.

middleware/cache/utils.go (1)

156-158: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Align the comment with the constant.

maxIgnoredHeaderLen is 32, but the longest name in ignoreHeaders is Proxy-Authorization (19 bytes). The constant is an upper bound, not the longest name. State it as a bound so a later reader does not shrink it to match the current list.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@middleware/cache/utils.go` around lines 156 - 158, Update the comment above
maxIgnoredHeaderLen to describe 32 as an upper bound for ignored header-name
lengths, not as the longest current name in ignoreHeaders; retain the constant
value and its folding behavior unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/extra/internal.md`:
- Around line 367-368: Update the cookie security description in “Setting a
Cookie” to limit protection from plaintext transport to cases where the Secure
attribute is set. Clarify that HTTP-originated requests may receive a non-Secure
fiber_flash cookie and therefore may transmit it over HTTP, while retaining the
existing HttpOnly and visibility statements.

In `@extractors/extractors.go`:
- Around line 348-351: Update FromAuthHeader to retrieve the authorization
header through headerlookup.Value instead of byte-exact c.Get, preserving the
existing scheme validation and authentication flow. Add coverage confirming
FromAuthHeader accepts differently cased authorization field names when header
normalization is disabled.

---

Nitpick comments:
In `@docs/middleware/cache.md`:
- Around line 127-211: Run the repository’s Markdown lint task with make
markdown after updating the new sections in the cache middleware documentation,
then fix any reported formatting issues in the hard-wrapped prose or fenced Go
example.

In `@middleware/adaptor/adaptor_test.go`:
- Around line 2300-2377: Add a subtest to Test_HTTPMiddleware_HeaderFidelity
using fiber.New(fiber.Config{DisableHeaderNormalizing: true}) and lowercase
content-length and x-forwarded-for request headers. Exercise the existing
middleware flow and assert framing headers remain correctly handled while the
lowercase forwarded-for value is preserved or replaced through
raw-spelling-aware deletion. Keep the test focused on clearCopiedHeaders and
isFramingHeader behavior without changing the existing canonical-header
subtests.

In `@middleware/cache/cache.go`:
- Around line 770-780: Remove the redundant v >= 0 condition in the ageVal
assignment within the response-header age parsing logic; when fasthttp.ParseUint
succeeds, assign v directly to ageVal, while preserving the existing error
handling and default header behavior.

In `@middleware/cache/utils.go`:
- Around line 156-158: Update the comment above maxIgnoredHeaderLen to describe
32 as an upper bound for ignored header-name lengths, not as the longest current
name in ignoreHeaders; retain the constant value and its folding behavior
unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c3909ac7-7dea-4592-bfd7-79986a40e80a

📥 Commits

Reviewing files that changed from the base of the PR and between a367aa9 and ddc5560.

📒 Files selected for processing (44)

• bind.go
• binder/form.go
• binder/form_test.go
• ctx_interface_gen.go
• ctx_test.go
• docs/api/ctx.md
• docs/extra/internal.md
• docs/middleware/cache.md
• docs/middleware/logger.md
• docs/middleware/proxy.md
• extractors/extractors.go
• extractors/extractors_test.go
• helpers.go
• helpers_test.go
• internal/crosshost/crosshost.go
• internal/fieldname/fieldname.go
• internal/headerlookup/headerlookup.go
• internal/mediatype/mediatype.go
• internal/mediatype/mediatype_test.go
• middleware/adaptor/adaptor.go
• middleware/adaptor/adaptor_test.go
• middleware/cache/cache.go
• middleware/cache/cache_security_test.go
• middleware/cache/cache_test.go
• middleware/cache/cachecontrol.go
• middleware/cache/coverage_test.go
• middleware/cache/keygen.go
• middleware/cache/keygen_test.go
• middleware/cache/utils.go
• middleware/cache/vary.go
• middleware/csrf/csrf.go
• middleware/csrf/csrf_test.go
• middleware/logger/context_tag.go
• middleware/logger/logger_test.go
• middleware/logger/tags.go
• middleware/proxy/bench_test.go
• middleware/proxy/fuzz_test.go
• middleware/proxy/proxy.go
• middleware/proxy/proxy_test.go
• middleware/proxy/security.go
• middleware/proxy/security_test.go
• redirect.go
• req.go
• req_interface_gen.go

💤 Files with no reviewable changes (1)

• helpers_test.go

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c36bcecae1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9cfe6cb9b3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 19949ed8a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dcc39c66b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8292a47de9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b2c6add953

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ef43f3f24d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Delete cross-host credentials case-insensitively

When callers use req.Header.DisableNormalizing() and add a lower-case credential such as authorization or cookie, RequestHeader.Del compares the stored name byte-for-byte, so this loop leaves the credential in place and sends it to an unrelated host selected by the redirect response. Use the case-insensitive deletion helper for every sensitive name so the cross-host protection also covers non-normalized requests.

AGENTS.md reference: AGENTS.md:L11-L13

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Make the new log-capture tests parallel-safe

This test and the other newly added warning tests intentionally omit t.Parallel() because they mutate package-level logging state, but the repository requires every new test and subtest to invoke it. Refactor the warning/log capture path to isolate or inject the logger, then run these tests and their subtests in parallel rather than adding serial exceptions.

AGENTS.md reference: AGENTS.md:L9-L9

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Remove non-normalized Expect headers with redirected bodies

For a request whose header normalization is disabled and whose field is stored as lower-case expect, this byte-exact deletion misses it. After a 301, 302, or 303, dropRequestBody therefore emits a bodyless redirected request that still carries Expect: 100-continue; as the adjacent comment notes, a strict target can answer 417 instead of completing the redirect. Delete this field case-insensitively, along with the other body metadata removed above.

AGENTS.md reference: AGENTS.md:L11-L11

Useful? React with 👍 / 👎.