Disallow case-insensitive duplicate header names

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/header_utils.py

@@ -17,6 +17,7 @@ def normalize_headers(
 
     effective_pair_error_message = pair_error_message or mapping_error_message
     normalized_headers: Dict[str, str] = {}
+    seen_header_names = set()
     for key, value in headers.items():
         if not isinstance(key, str) or not isinstance(value, str):
             raise HyperbrowserError(effective_pair_error_message)
@@ -30,10 +31,12 @@ def normalize_headers(
             or "\r" in value
         ):
             raise HyperbrowserError("headers must not contain newline characters")
-        if normalized_key in normalized_headers:
+        canonical_header_name = normalized_key.lower()
+        if canonical_header_name in seen_header_names:
             raise HyperbrowserError(
                 "duplicate header names are not allowed after normalization"
             )
+        seen_header_names.add(canonical_header_name)
         normalized_headers[normalized_key] = value
     return normalized_headers
 

tests/test_config.py

@@ -227,6 +227,17 @@ def test_client_config_rejects_duplicate_header_names_after_normalization():
         )
 
 
+def test_client_config_rejects_case_insensitive_duplicate_header_names():
+    with pytest.raises(
+        HyperbrowserError,
+        match="duplicate header names are not allowed after normalization",
+    ):
+        ClientConfig(
+            api_key="test-key",
+            headers={"X-Correlation-Id": "one", "x-correlation-id": "two"},
+        )
+
+
 def test_client_config_accepts_mapping_header_inputs():
     headers = MappingProxyType({"X-Correlation-Id": "abc123"})
     config = ClientConfig(api_key="test-key", headers=headers)

tests/test_header_utils.py

@@ -32,6 +32,17 @@ def test_normalize_headers_rejects_duplicate_names_after_normalization():
         )
 
 
+def test_normalize_headers_rejects_case_insensitive_duplicate_names():
+    with pytest.raises(
+        HyperbrowserError,
+        match="duplicate header names are not allowed after normalization",
+    ):
+        normalize_headers(
+            {"X-Trace-Id": "one", "x-trace-id": "two"},
+            mapping_error_message="headers must be a mapping of string pairs",
+        )
+
+
 def test_parse_headers_env_json_ignores_blank_values():
     assert parse_headers_env_json("   ") is None