An http header is like:
header-name:header-value
The header-name is immediately followed by a colon. There can be one or more spaces between the header-value and the colon. There can be one or more spaces after header-value. There can be multiple headers with the same header name, which is equivalent with a single header with header-value formed by combining all the header values of that header name separated by comma. So, the order of the headers with the same name has significance. The header can occupy multiple continuous lines but the lines except the first one must begin with one or more spaces.
Are http headers case-insensitive? The http header names are case-insensitive. So “Content-Type” is equivalent with “content-type”.
Are http header values case-insensitive? That depends on the header name. Some headers have case-insensitive values, others have case-sensitive values. For example, the mime type in Content-Type header is case-insensitive:
The type, subtype, and parameter names are not case sensitive. For example, TEXT, Text, and TeXt are all equivalent top-level media types. Parameter values are normally case sensitive, but sometimes are interpreted in a case-insensitive fashion, depending on the intended use. (For example, multipart boundaries are case-sensitive, but the “access-type” parameter for message/External-body is not case-sensitive.)
So “Content-Type:text/plain” and “Content-Type:TEXT/PLAIN” are equivalent. “Content-Type:text/plain;charset=uft-8” and “Content-Type:TEXT/PLAIN;Charset=UTF-8” are equivalent. Note that although parameter values are usually case-sensitive, the value of charset is case-insensitive.
The header value for Set-Cookie
header is case-sensitive. The header field value for the Connection header is case-insensitive.
References:
https://stackoverflow.com/questions/7718476/are-http-headers-content-type-c-case-sensitive