Im troubleshooting a server that behaves a bit odd. If I make a request that looks like this:
GET / HTTP/1.1
Connection: close
Host: hostname
Someheader: somevalue
Location: Woot?
Set-Cookie: test=funtimes;
I will get a response with all the headers I have sent.
HTTP/1.1 200 OK
Host: hostname
Set-Cookie: test=funtimes
Content-Type: application/json
Someheader: somevalue
Location: Woot?
As you can see, headers are echoed back to the client. I have not seen this before, and I do not think many other people have either.
Can you see any potential security issues with this kind of behavior?