Spring Security Under certain load the HTTP header response has changed

During a JMeter test I have discovered that after 20/30 seconds of test, the HTTP response is changed. As far as I have studied the documentation this behavior is not documented.

The changes i've noticed: - The parameters becomes lowercase (i know the specification says the header are case-insentive but consistency is appreciated) - Two extra params are added - One param has double ::

To Reproduce My project is a simple HTTP server with Sopring Security and Redis for sessions. I can reproduce just as simple as runner a jmeter test pointing to a single endpoint and wait a couple of seconds. If using jmeter, which is not required, just activate the check of HTTP headers in a "View Results Tree" configuration.

Expected behavior This is a normal HTTP Response i normally got from my server ´´´ HTTP/1.1 200 Vary: origin,access-control-request-method,access-control-request-headers,accept-encoding X-Auth-Token: xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx Content-Type: application/json Transfer-Encoding: chunked Date: Tue, 12 Dec 2023 17:28:16 GMT ´´´

this is what i got after a 20 or 30 seconds of load

HTTP/1.1 200 
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
x-auth-token: xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
content-type: application/json
transfer-encoding: chunked
date: Tue, 12 Dec 2023 17:29:55 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options:: nosniff

notice x-content-type-options:: nosniff has double ::

Please forward this issue to the proper project, i assumed this should be security but honestly, i'm not sure. Thanks

Comment From: jzheaux

Thanks for reaching out, @Canos. That's certainly an interesting issue.

Are you able to provide a minimal sample that can be used to reproduce the issue? Please remove as much application code as possible, leaving only the components necessary to observe the behavior.

Comment From: spring-projects-issues

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

Comment From: spring-projects-issues

Closing due to lack of requested feedback. If you would like us to look at this issue, please provide the requested information and we will re-open the issue.