HTTP Header Singleton Occurrence Audit

Description

Audit repeated HTTP fields only for caller-declared singleton names; does not invent a universal singleton table or enforce request-smuggling policy.

HTTP field names are case-insensitive, while values follow each field’s own grammar. Repeated occurrences sometimes form lists but cannot always be combined. Quoted values, optional spaces/tabs and quality weights need their own treatment; the tools here use explicit field records or a stated text subset.^[1]

Audit repeated HTTP fields only for caller-declared singleton names; does not invent a universal singleton table or enforce request-smuggling policy.

When to use this tool

Use this tool to audit repeated HTTP fields only for caller-declared singleton names; does not invent a universal singleton table or enforce request-smuggling policy.

How to use the tool and how it works

Enter headersJson, singletonNames using the field definitions below. For JSON text, serialize the explicit records in the shown shape.
Run the operation. Correct input errors before interpreting an output.
Read result.violations. Use the ordering, boundary rules and absence conditions described below.

Group header occurrences case-insensitively and report repeated groups only for the caller-declared singleton names.^[2]

Input field	Meaning and units	Accepted input
headersJson	JSON text encoding array of {name: string, value: string}. Keep the record keys and value types shown in the decoded example below.	Text, at most 8,192 UTF-16 code units; the operation’s grammar also applies.
singletonNames	Caller-declared names that should occur at most once.	Dense list of at most 128 strings, each at most 8,192 UTF-16 code units.

These are the decoded structures used in the example’s JSON text fields. Supply the corresponding serialized JSON strings as input.

json

{
  "headersJson": [
    {
      "name": "X-A",
      "value": "one"
    },
    {
      "name": "x-a",
      "value": "two"
    },
    {
      "name": "Set-Cookie",
      "value": "a=1"
    }
  ]
}

Output field	Interpretation
result	Object containing the named fields below.
result.violations	Original indexes of forbidden field-value code units or repeated caller-declared singleton groups.

json

{
  "input": {
    "headersJson": "[{\"name\":\"X-A\",\"value\":\"one\"},{\"name\":\"x-a\",\"value\":\"two\"},{\"name\":\"Set-Cookie\",\"value\":\"a=1\"}]",
    "singletonNames": [
      "X-A"
    ]
  },
  "output": {
    "result": {
      "violations": [
        {
          "key": "x-a",
          "indexes": [
            0,
            1
          ]
        }
      ]
    }
  }
}

Limitations and assumptions

The singleton policy is supplied; the tool does not maintain a universal header-policy registry.
Explicit header records have name and value strings. Names must use token syntax; supported value code units are tab or 32–255 excluding DEL. Byte budgets use that single-byte representation, not UTF-8 or HTTP/2 compression.
Every declared top-level input field is required and unexpected fields are rejected. Ordinary strings are limited to 8,192 UTF-16 code units and lists to 128 entries, with tighter operation-specific bounds where stated. JSON text has bounded nesting and node counts.
Numeric outputs must be finite and no larger in absolute magnitude than the safe-integer limit; operations returning exact large integers use decimal text. Positions are zero-based and spans end exclusively unless the operation explicitly states a different convention.

Alternative or Complementary methods

Choose field-specific parsing and combination rules rather than applying one policy to every header. Preserve occurrence order and use a full HTTP implementation for message framing and protocol-level decisions.

References

RFC 9110: HTTP Semantics — RFC Editor
Tool behavior and example: HTTP Header Singleton Occurrence Audit — tool.io

Similar or alternative tools

HTTP Header Occurrence Byte Budget
Budget HTTP/1 field section octets under literal name-colon-space-value-CRLF serialization plus final CRLF; Latin-1 octets, not HTTP/2 compression or UTF-8.
HTTP Header Occurrence Case Collisions
Audit HTTP field-name spelling collisions separately from repeated identical spellings; validates token names and Latin-1 field-value octets.