哪个 HTTP header 在服务器发送相同的 HTTP Z099FB995346F31C3549F6E40DB0 时实现不同的 EZ？

Question

I came across this one website made in PHP. access-control-allow-origin header is repeated thrice. I want to know how is this response handled. Does the latter one hold more precedence than previous one or is it the other way around? Or both hold equal significance?

Answer 1

In general: all of them, comma-separated. See https://greenbytes.de/tech/webdav/rfc7230.html#rfc.section.3.2.2 :

A recipient MAY combine multiple header fields with the same field name into one "field-name: field-value" pair, without changing the semantics of the message, by appending each subsequent field value to the combined field value in order, separated by a comma. The order in which header fields with the same field name are received is therefore significant to the interpretation of the combined field value; a proxy MUST NOT change the order of these field values when forwarding a message.