TL:DR; CFHTTPMessage combines duplicate headers to a single string value containing all headers comma seperated. Thank you.

I am currently developing a Proxy app that visualizes requests and gives you the ability to plug-and-play like filter and modify requests, which makes it a quite powerful tool for debugging web applications, mobile apps and so on.

Of course, this tool is built using Cocoa and Core Foundation. Interesting enough, Core Foundation brings a Type called "CFHTTPMessage", which handles a lot of low-level message parsing and processing, and is really handy and quite easy to use.

There is one drawback: CFHTTPMessage is not designed to handle both the order in which the headers arrived in a message and duplicate header fields. The first point is somewhat irrelevant, as the HTTP1.1 standard points out that servers are not supposed to depend on any order in the clients – it's really only a minor issue. The latter point is complicated. HTTP relies on duplicate headers a lot, consider this HTTP request ( Real life!! )

POST /wp-admin/admin-ajax.php HTTP/1.1
X-Requested-With: XMLHttpRequest
Accept-Charset: ISO-8859-1
Accept-Charset: utf-8;q=0.7
Accept-Charset: *;q=0.3
Accept-Encoding: gzip,deflate,sdch
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Cookie: word
Cookie: wordpress_xxxxxxxx
Cookie: wordpress_logged_in_xxxxxx; httponly; expires=Tue
Referer: /wp-admin/post-new.php
Accept-Language: de-DE
Accept-Language: de;q=0.8
Accept-Language: en-US;q=0.6
Accept-Language: en;q=0.4
Accept: */*
Content-Length: 1160

There are quite some duplicates here. So the clever guys at Cupertino just forgot to handle duplicate headers at all? No, not really. But they just didn't document what they are doing with it, which isn't that clever at all, but fortunately, the sources are available here. So after a bit of digging, I found out that duplicates are simply appended to a former header with same key, which sucks – the delimiter used is a simple comma, which is quite regularly found in header values, which makes splitting an art for itself.