Im troubleshooting a server that behaves a bit odd. If I make a request that looks like this:
GET / HTTP/1.1 Connection: close Host: hostname Someheader: somevalue Location: Woot? Set-Cookie: test=funtimes;
I will get a response with all the headers I have sent.
HTTP/1.1 200 OK Host: hostname Set-Cookie: test=funtimes Content-Type: application/json Someheader: somevalue Location: Woot?
As you can see, headers are echoed back to the client. I have not seen this before, and I do not think many other people have either.
Can you see any potential security issues with this kind of behavior?