http - HTTP header 是否区分空格/大小写/顺序？

Question

让我们假设我有这些 header :

Strict-Transport-Security: max-age=<expire-time>
Strict-Transport-Security: max-age=<expire-time>; includeSubDomains
Strict-Transport-Security: max-age=<expire-time>; preload

为了编写正则表达式，我需要知道:

标题空间敏感吗？例如max-age=<expire-time> vs. Max-age=<expire-time> 它们区分大小写吗？例如max-age= <expire-time> vs. Max-age=<expire-time> 他们对订单敏感吗？例如max-age=<expire-time>; preload vs. preload; max-age=<expire-time>;

Answer 1

回答此类问题的来源是标准 - 这就是标准的用途。引用自 RFC 7230 section 3.2 :

Each header field consists of a case-insensitive field name followed by a colon (":"), optional leading whitespace, the field value, and optional trailing whitespace.

至于字段值，这个要看实际的header。例如 Set-Cookie 中的值是区分大小写的。对于 Strict-Transport-Security，您必须查看相关标准。在 RFC 6797 it says in section 6.1 :

1. The order of appearance of directives is not significant.
   ...
2. Directive names are case-insensitive.