{"record":{"id":"1fa481cd87ea36d3","repo":"sveltejs/kit","slug":"multiple-values-provided-for-name-header-where","errorCode":null,"errorMessage":"Multiple values provided for ${name} header where only one expected: ${value}","messagePattern":"Multiple values provided for (.+?) header where only one expected: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/adapter-node/src/handler.js","lineNumber":232,"sourceCode":"\t\t\t\treturn next();\n\t\t\t}\n\t\t}\n\n\t\treturn handle(0);\n\t};\n}\n\n/**\n * @param {string} name\n * @param {string | string[] | undefined} value\n * @returns {string | undefined}\n */\nfunction normalise_header(name, value) {\n\tif (!name) return undefined;\n\tif (Array.isArray(value)) {\n\t\tif (value.length === 0) return undefined;\n\t\tif (value.length === 1) return value[0];\n\t\tthrow new Error(\n\t\t\t`Multiple values provided for ${name} header where only one expected: ${value}`\n\t\t);\n\t}\n\treturn value;\n}\n\n/**\n * @param {IncomingHttpHeaders} headers\n * @returns {string}\n */\nfunction get_origin(headers) {\n\tconst protocol = decodeURIComponent(\n\t\tnormalise_header(protocol_header, headers[protocol_header]) || 'https'\n\t);\n\n\t// this helps us avoid host injections through the protocol header\n\tif (protocol.includes(':')) {\n\t\tthrow new Error(","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/adapter-node/src/handler.js#L214-L250","documentation":"Some headers (protocol/host/port) must contain exactly one value to build the request origin. `normalise_header` accepts absent, empty, or single-valued headers, but throws when an HTTP/2-style or duplicated header arrives as an array with more than one value, since choosing one would be ambiguous and spoofable.","triggerScenarios":"A request contains the configured PROTOCOL_HEADER, HOST_HEADER, or PORT_HEADER with multiple comma/array entries (value.length > 1).","commonSituations":"Misconfigured proxies sending a header twice, or HTTP/2 pseudo-header conversions producing arrays instead of a single string.","solutions":["Fix the proxy/gateway so it emits the header at most once per request","Choose a different header that is guaranteed single-valued","Intercept/dedupe the header at the proxy layer before it reaches the Node server"],"exampleFix":"// nginx: before\nadd_header x-forwarded-proto https;\nadd_header x-forwarded-proto https;\n// after\nadd_header x-forwarded-proto https; # only once","handlingStrategy":"validation","validationCode":"const v = req.headers['x-forwarded-proto'];\nif (Array.isArray(v) && v.length > 1) {\n  throw new Error('x-forwarded-proto sent multiple times; fix proxy config');\n}","typeGuard":"function isSingleValue(v) {\n  return !Array.isArray(v) || v.length <= 1;\n}","tryCatchPattern":"try {\n  origin = getOrigin(headers);\n} catch (err) {\n  if (String(err.message).includes('Multiple values provided')) {\n    console.error('Proxy duplicates a trusted header; dedupe at the proxy layer');\n  } else {\n    throw err;\n  }\n}","preventionTips":["Audit proxy config for duplicate add_header/proxy_set_header lines","Prefer headers overwritten (not appended) by every proxy hop","Test with HTTP/2 clients where headers may arrive as arrays"],"tags":["http","headers","security"],"backgroundTag":"duplicate-http-header","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}