--- title: Common HTTP Implementation Quirks | daily.dev description: A rundown of surprising but common HTTP implementation quirks encountered while operating a large-scale webhook sending service. Covers header case-sensitivity... canonical: https://daily.dev/posts/common-http-implementation-quirks-twe8isnci twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Common HTTP Implementation Quirks | daily.dev og:description: A rundown of surprising but common HTTP implementation quirks encountered while operating a large-scale webhook sending service. Covers header case-sensitivity... og:url: https://daily.dev/posts/common-http-implementation-quirks-twe8isnci og:image: https://api.daily.dev/og/posts/tWE8ISNci.png og:image:alt: Common HTTP Implementation Quirks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Common HTTP Implementation Quirks **[Svix Blog](https://daily.dev/sources/svix)** · 6 min read · 0 upvotes · 0 comments ## Summary A rundown of surprising but common HTTP implementation quirks encountered while operating a large-scale webhook sending service. Covers header case-sensitivity inconsistencies across frameworks, invalid header names not being enforced, header ordering requirements from middleboxes, headers appearing multiple times or with multiple comma-separated values, the many incompatible ways of encoding array query parameters (bracket notation, indexed, repeated params, comma or pipe delimited), TLS cipher negotiation failures between old and new implementations, incomplete certificate chains, and gotchas with HTTP Basic Authentication such as optional username/password and inconsistent client library support. The overall message is that HTTP implementations vary widely in practice despite the spec, so client and server code needs to be defensively flexible. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does my code break when a header appears more than once in an HTTP request? HTTP allows the same header name to appear multiple times, and per spec those values should be combined into one comma-separated value, equivalent to sending them as a single header. For example, two separate Accept headers for text/plain and text/html are equivalent to one Accept header set to 'text/plain, text/html'. Some implementations mishandle this and simply overwrite one value with the other instead of combining them. _Teams debugging inconsistent header parsing across services can track HTTP edge cases like this on daily.dev._ ### What are the different ways to pass an array as a URL query parameter? There are at least five common conventions: non-indexed brackets (arr[]=foo&arr[]=bar), indexed brackets (arr[0]=foo&arr[1]=bar), repeating the same parameter name (arr=foo&arr=bar, the OpenAPI default), comma-delimited values (arr=foo,bar,baz), and pipe-delimited values (arr=foo|bar|baz). Client and server must agree on the convention, since naive implementations often assume only one format or fail to escape delimiters correctly. _Developers designing or consuming APIs can compare query-param conventions like these on daily.dev before picking one._ ### Why would my HTTPS connection fail even though both client and server support TLS? The connection can fail during cipher negotiation if the client and server do not share any common supported cipher, which happens when an old server only supports outdated ciphers while a modern TLS library has dropped them, or a cutting-edge library refuses to support legacy ciphers. This mismatch causes the server to reject the connection outright rather than falling back to a working cipher. _Engineers troubleshooting TLS handshake failures can find practical HTTP and TLS gotchas like this on daily.dev._ ## Similar posts on daily.dev - [The Most Overlooked Vulnerability — Http request Smuggling](https://daily.dev/posts/the-most-overlooked-vulnerability-http-request-smuggling-bkxsg4njj) · InfoSec Write-ups · 0 upvotes · 0 comments - [HTTP/2 and HTTP/3: what changed and why it matters](https://daily.dev/posts/http-2-and-http-3-what-changed-and-why-it-matters-kxd7rny7x) · Flavio Copes · 1 upvotes · 0 comments - [HTTP QUERY: The New Method That Fixes a Decades-Old Problem](https://daily.dev/posts/http-query-the-new-method-that-fixes-a-decades-old-problem-sp7tnm5fm) · Medium · 84 upvotes · 11 comments - [Your Webhook Endpoint Is a Tiny Distributed System](https://daily.dev/posts/your-webhook-endpoint-is-a-tiny-distributed-system-izgpxyxum) · Ruby Flow · 0 upvotes · 0 comments --- Tags: [#webdev](https://daily.dev/tags/webdev), [#architecture](https://daily.dev/tags/architecture) [View this post on daily.dev](https://daily.dev/posts/common-http-implementation-quirks-twe8isnci) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Common HTTP Implementation Quirks","url":"https://daily.dev/posts/common-http-implementation-quirks-twe8isnci","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/common-http-implementation-quirks-twe8isnci"},"datePublished":"2026-08-23T07:20:37.649Z","dateModified":"2026-08-23T07:26:13.269Z","description":"A rundown of surprising but common HTTP implementation quirks encountered while operating a large-scale webhook sending service. Covers header case-sensitivity...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/168e7c6030ae71005ec58330e54515df?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/168e7c6030ae71005ec58330e54515df?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Svix Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Svix Blog","logo":"https://media.daily.dev/image/upload/s--Shf9MlOr--/f_auto,q_auto/v1787469609/logos/svix?_a=BAMAMicg0","url":"https://daily.dev/sources/svix"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/common-http-implementation-quirks-twe8isnci","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"webdev,architecture","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Svix Blog","item":"https://daily.dev/sources/svix"},{"@type":"ListItem","position":3,"name":"Common HTTP Implementation Quirks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/common-http-implementation-quirks-twe8isnci#faq","mainEntity":[{"@type":"Question","name":"Why does my code break when a header appears more than once in an HTTP request?","acceptedAnswer":{"@type":"Answer","text":"HTTP allows the same header name to appear multiple times, and per spec those values should be combined into one comma-separated value, equivalent to sending them as a single header. For example, two separate Accept headers for text/plain and text/html are equivalent to one Accept header set to 'text/plain, text/html'. Some implementations mishandle this and simply overwrite one value with the other instead of combining them. Teams debugging inconsistent header parsing across services can track HTTP edge cases like this on daily.dev."}},{"@type":"Question","name":"What are the different ways to pass an array as a URL query parameter?","acceptedAnswer":{"@type":"Answer","text":"There are at least five common conventions: non-indexed brackets (arr[]=foo&arr[]=bar), indexed brackets (arr[0]=foo&arr[1]=bar), repeating the same parameter name (arr=foo&arr=bar, the OpenAPI default), comma-delimited values (arr=foo,bar,baz), and pipe-delimited values (arr=foo|bar|baz). Client and server must agree on the convention, since naive implementations often assume only one format or fail to escape delimiters correctly. Developers designing or consuming APIs can compare query-param conventions like these on daily.dev before picking one."}},{"@type":"Question","name":"Why would my HTTPS connection fail even though both client and server support TLS?","acceptedAnswer":{"@type":"Answer","text":"The connection can fail during cipher negotiation if the client and server do not share any common supported cipher, which happens when an old server only supports outdated ciphers while a modern TLS library has dropped them, or a cutting-edge library refuses to support legacy ciphers. This mismatch causes the server to reject the connection outright rather than falling back to a working cipher. Engineers troubleshooting TLS handshake failures can find practical HTTP and TLS gotchas like this on daily.dev."}}]} ```