From 17677bf79e056b1ae73b76bd46e063bdbdc24a31 Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Mon, 26 Dec 2022 15:46:54 +0100
Subject: [PATCH 01/12] http: join authorization headers

---
 doc/api/cli.md                                |  6 +++++
 lib/_http_incoming.js                         | 13 ++++++++++
 src/node_options.cc                           |  5 ++++
 src/node_options.h                            |  1 +
 ...ttp-request-merge-authorization-headers.js | 24 +++++++++++++++++++
 5 files changed, 49 insertions(+)
 create mode 100644 test/parallel/test-http-request-merge-authorization-headers.js

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 8206bd2ce1b87d..d3609e04ab1252 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -456,6 +456,11 @@ added: v12.3.0
 
 Enable experimental WebAssembly module support.
 
+### `--experimental-join-authorization-headers`
+
+Enable experimental joining of the field line values of
+multiple `Authorization` headers in a request.
+
 ### `--force-context-aware`
 
 <!-- YAML
@@ -1884,6 +1889,7 @@ Node.js options that are allowed are:
 * `--experimental-vm-modules`
 * `--experimental-wasi-unstable-preview1`
 * `--experimental-wasm-modules`
+* `--experimental-join-authorization-headers`
 * `--force-context-aware`
 * `--force-fips`
 * `--force-node-api-uncaught-exceptions-policy`
diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
index 950c8c6e08bbc9..8c1242d5b6d4d5 100644
--- a/lib/_http_incoming.js
+++ b/lib/_http_incoming.js
@@ -31,6 +31,9 @@ const {
 } = primordials;
 
 const { Readable, finished } = require('stream');
+const { getOptionValue } = require('internal/options');
+
+const joinAuthorizationHeaders = getOptionValue('--experimental-join-authorization-headers');
 
 const kHeaders = Symbol('kHeaders');
 const kHeadersDistinct = Symbol('kHeadersDistinct');
@@ -400,6 +403,16 @@ function _addHeaderLine(field, value, dest) {
     } else {
       dest['set-cookie'] = [value];
     }
+  } else if (joinAuthorizationHeaders && flag === 97) {
+    // RFC 9110 https://www.rfc-editor.org/rfc/rfc9110#section-5.2
+    // https://github.com/nodejs/node/issues/45699
+    // allow authorization multiple fields
+    // Make a delimited list
+    if (typeof dest[field] === 'string') {
+      dest[field] += ', ' + value;
+    } else {
+      dest[field] = value;
+    }
   } else if (dest[field] === undefined) {
     // Drop duplicates
     dest[field] = value;
diff --git a/src/node_options.cc b/src/node_options.cc
index 6fccb8bf016338..68b9c798fb6271 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -381,6 +381,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "experimental ES Module support for webassembly modules",
             &EnvironmentOptions::experimental_wasm_modules,
             kAllowedInEnvvar);
+  AddOption("--experimental-join-authorization-headers",
+            "experimental joining of the field line values "
+            "of multiple Authorization headers",
+            &EnvironmentOptions::experimental_join_authorization_headers,
+            kAllowedInEnvvar);
   AddOption("--experimental-import-meta-resolve",
             "experimental ES Module import.meta.resolve() support",
             &EnvironmentOptions::experimental_import_meta_resolve,
diff --git a/src/node_options.h b/src/node_options.h
index 872a846c72f6d6..bc32be894e951f 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -115,6 +115,7 @@ class EnvironmentOptions : public Options {
   bool experimental_global_web_crypto = true;
   bool experimental_https_modules = false;
   bool experimental_wasm_modules = false;
+  bool experimental_join_authorization_headers = false;
   bool experimental_import_meta_resolve = false;
   std::string module_type;
   std::string experimental_policy;
diff --git a/test/parallel/test-http-request-merge-authorization-headers.js b/test/parallel/test-http-request-merge-authorization-headers.js
new file mode 100644
index 00000000000000..a2445c5bfb9d4a
--- /dev/null
+++ b/test/parallel/test-http-request-merge-authorization-headers.js
@@ -0,0 +1,24 @@
+// Flags: --experimental-join-authorization-headers
+
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const http = require('http');
+
+{
+  const server = http.createServer({ requireHostHeader: false }, common.mustCall((req, res) => {
+    assert.strictEqual(req.headers.authorization, '1, 2');
+    res.writeHead(200, ['authorization', '3', 'authorization', '4']);
+    res.end();
+  }));
+
+  server.listen(0, common.mustCall(() => {
+    http.get({ port: server.address().port, headers: ['authorization', '1', 'authorization', '2'] }, (res) => {
+      assert.strictEqual(res.statusCode, 200);
+      assert.strictEqual(res.headers.authorization, '3, 4');
+      res.resume().on('end', common.mustCall(() => {
+        server.close();
+      }));
+    });
+  }));
+}

From de0749bd8060a95ede9f6c8df505b15269798d4e Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Mon, 26 Dec 2022 16:08:59 +0100
Subject: [PATCH 02/12] http: added more doc

---
 doc/api/cli.md  | 3 ++-
 doc/api/http.md | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index d3609e04ab1252..19ec885fc64771 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -460,6 +460,7 @@ Enable experimental WebAssembly module support.
 
 Enable experimental joining of the field line values of
 multiple `Authorization` headers in a request.
+The values are joined together with `, `.
 
 ### `--force-context-aware`
 
@@ -1878,6 +1879,7 @@ Node.js options that are allowed are:
 * `--enable-source-maps`
 * `--experimental-abortcontroller`
 * `--experimental-import-meta-resolve`
+* `--experimental-join-authorization-headers`
 * `--experimental-json-modules`
 * `--experimental-loader`
 * `--experimental-modules`
@@ -1889,7 +1891,6 @@ Node.js options that are allowed are:
 * `--experimental-vm-modules`
 * `--experimental-wasi-unstable-preview1`
 * `--experimental-wasm-modules`
-* `--experimental-join-authorization-headers`
 * `--force-context-aware`
 * `--force-fips`
 * `--force-node-api-uncaught-exceptions-policy`
diff --git a/doc/api/http.md b/doc/api/http.md
index 37bb05b53a8872..c8e6b5e4716291 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -2454,6 +2454,9 @@ header name:
 * `set-cookie` is always an array. Duplicates are added to the array.
 * For duplicate `cookie` headers, the values are joined together with `; `.
 * For all other headers, the values are joined together with `, `.
+* To enable joining the value of duplicate `authorization` header,
+  use the experimental command line flag `--experimental-join-authorization-headers`.
+  See [`--experimental-join-authorization-headers`][] for more information.
 
 ### `message.headersDistinct`
 
@@ -3731,6 +3734,7 @@ Set the maximum number of idle HTTP parsers. **Default:** `1000`.
 [`'request'`]: #event-request
 [`'response'`]: #event-response
 [`'upgrade'`]: #event-upgrade
+[`--experimental-join-authorization-headers`]: cli.md#--experimental-join-authorization-headers
 [`--insecure-http-parser`]: cli.md#--insecure-http-parser
 [`--max-http-header-size`]: cli.md#--max-http-header-sizesize
 [`Agent`]: #class-httpagent

From 5510be60fe9a1dea8e8f475c48a22c1726551cf4 Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Wed, 28 Dec 2022 20:36:59 +0100
Subject: [PATCH 03/12] Revert "http: added more doc"

This reverts commit de0749bd8060a95ede9f6c8df505b15269798d4e.
---
 doc/api/cli.md  | 3 +--
 doc/api/http.md | 4 ----
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 19ec885fc64771..d3609e04ab1252 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -460,7 +460,6 @@ Enable experimental WebAssembly module support.
 
 Enable experimental joining of the field line values of
 multiple `Authorization` headers in a request.
-The values are joined together with `, `.
 
 ### `--force-context-aware`
 
@@ -1879,7 +1878,6 @@ Node.js options that are allowed are:
 * `--enable-source-maps`
 * `--experimental-abortcontroller`
 * `--experimental-import-meta-resolve`
-* `--experimental-join-authorization-headers`
 * `--experimental-json-modules`
 * `--experimental-loader`
 * `--experimental-modules`
@@ -1891,6 +1889,7 @@ Node.js options that are allowed are:
 * `--experimental-vm-modules`
 * `--experimental-wasi-unstable-preview1`
 * `--experimental-wasm-modules`
+* `--experimental-join-authorization-headers`
 * `--force-context-aware`
 * `--force-fips`
 * `--force-node-api-uncaught-exceptions-policy`
diff --git a/doc/api/http.md b/doc/api/http.md
index c8e6b5e4716291..37bb05b53a8872 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -2454,9 +2454,6 @@ header name:
 * `set-cookie` is always an array. Duplicates are added to the array.
 * For duplicate `cookie` headers, the values are joined together with `; `.
 * For all other headers, the values are joined together with `, `.
-* To enable joining the value of duplicate `authorization` header,
-  use the experimental command line flag `--experimental-join-authorization-headers`.
-  See [`--experimental-join-authorization-headers`][] for more information.
 
 ### `message.headersDistinct`
 
@@ -3734,7 +3731,6 @@ Set the maximum number of idle HTTP parsers. **Default:** `1000`.
 [`'request'`]: #event-request
 [`'response'`]: #event-response
 [`'upgrade'`]: #event-upgrade
-[`--experimental-join-authorization-headers`]: cli.md#--experimental-join-authorization-headers
 [`--insecure-http-parser`]: cli.md#--insecure-http-parser
 [`--max-http-header-size`]: cli.md#--max-http-header-sizesize
 [`Agent`]: #class-httpagent

From 3e1b292eff16d14b739b3a51da6499b6a59f7c2e Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Wed, 28 Dec 2022 20:37:56 +0100
Subject: [PATCH 04/12] Revert "http: join authorization headers"

This reverts commit 17677bf79e056b1ae73b76bd46e063bdbdc24a31.
---
 doc/api/cli.md                                |  6 -----
 lib/_http_incoming.js                         | 13 ----------
 src/node_options.cc                           |  5 ----
 src/node_options.h                            |  1 -
 ...ttp-request-merge-authorization-headers.js | 24 -------------------
 5 files changed, 49 deletions(-)
 delete mode 100644 test/parallel/test-http-request-merge-authorization-headers.js

diff --git a/doc/api/cli.md b/doc/api/cli.md
index d3609e04ab1252..8206bd2ce1b87d 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -456,11 +456,6 @@ added: v12.3.0
 
 Enable experimental WebAssembly module support.
 
-### `--experimental-join-authorization-headers`
-
-Enable experimental joining of the field line values of
-multiple `Authorization` headers in a request.
-
 ### `--force-context-aware`
 
 <!-- YAML
@@ -1889,7 +1884,6 @@ Node.js options that are allowed are:
 * `--experimental-vm-modules`
 * `--experimental-wasi-unstable-preview1`
 * `--experimental-wasm-modules`
-* `--experimental-join-authorization-headers`
 * `--force-context-aware`
 * `--force-fips`
 * `--force-node-api-uncaught-exceptions-policy`
diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
index 8c1242d5b6d4d5..950c8c6e08bbc9 100644
--- a/lib/_http_incoming.js
+++ b/lib/_http_incoming.js
@@ -31,9 +31,6 @@ const {
 } = primordials;
 
 const { Readable, finished } = require('stream');
-const { getOptionValue } = require('internal/options');
-
-const joinAuthorizationHeaders = getOptionValue('--experimental-join-authorization-headers');
 
 const kHeaders = Symbol('kHeaders');
 const kHeadersDistinct = Symbol('kHeadersDistinct');
@@ -403,16 +400,6 @@ function _addHeaderLine(field, value, dest) {
     } else {
       dest['set-cookie'] = [value];
     }
-  } else if (joinAuthorizationHeaders && flag === 97) {
-    // RFC 9110 https://www.rfc-editor.org/rfc/rfc9110#section-5.2
-    // https://github.com/nodejs/node/issues/45699
-    // allow authorization multiple fields
-    // Make a delimited list
-    if (typeof dest[field] === 'string') {
-      dest[field] += ', ' + value;
-    } else {
-      dest[field] = value;
-    }
   } else if (dest[field] === undefined) {
     // Drop duplicates
     dest[field] = value;
diff --git a/src/node_options.cc b/src/node_options.cc
index 68b9c798fb6271..6fccb8bf016338 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -381,11 +381,6 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "experimental ES Module support for webassembly modules",
             &EnvironmentOptions::experimental_wasm_modules,
             kAllowedInEnvvar);
-  AddOption("--experimental-join-authorization-headers",
-            "experimental joining of the field line values "
-            "of multiple Authorization headers",
-            &EnvironmentOptions::experimental_join_authorization_headers,
-            kAllowedInEnvvar);
   AddOption("--experimental-import-meta-resolve",
             "experimental ES Module import.meta.resolve() support",
             &EnvironmentOptions::experimental_import_meta_resolve,
diff --git a/src/node_options.h b/src/node_options.h
index bc32be894e951f..872a846c72f6d6 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -115,7 +115,6 @@ class EnvironmentOptions : public Options {
   bool experimental_global_web_crypto = true;
   bool experimental_https_modules = false;
   bool experimental_wasm_modules = false;
-  bool experimental_join_authorization_headers = false;
   bool experimental_import_meta_resolve = false;
   std::string module_type;
   std::string experimental_policy;
diff --git a/test/parallel/test-http-request-merge-authorization-headers.js b/test/parallel/test-http-request-merge-authorization-headers.js
deleted file mode 100644
index a2445c5bfb9d4a..00000000000000
--- a/test/parallel/test-http-request-merge-authorization-headers.js
+++ /dev/null
@@ -1,24 +0,0 @@
-// Flags: --experimental-join-authorization-headers
-
-'use strict';
-const common = require('../common');
-const assert = require('assert');
-const http = require('http');
-
-{
-  const server = http.createServer({ requireHostHeader: false }, common.mustCall((req, res) => {
-    assert.strictEqual(req.headers.authorization, '1, 2');
-    res.writeHead(200, ['authorization', '3', 'authorization', '4']);
-    res.end();
-  }));
-
-  server.listen(0, common.mustCall(() => {
-    http.get({ port: server.address().port, headers: ['authorization', '1', 'authorization', '2'] }, (res) => {
-      assert.strictEqual(res.statusCode, 200);
-      assert.strictEqual(res.headers.authorization, '3, 4');
-      res.resume().on('end', common.mustCall(() => {
-        server.close();
-      }));
-    });
-  }));
-}

From fa8aa5c3cca3c91034434a9d506f2dac1c3deb37 Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Wed, 28 Dec 2022 23:53:55 +0100
Subject: [PATCH 05/12] http: joinAuthorizationHeaders

---
 doc/api/http.md                               |  4 +++
 lib/_http_client.js                           | 11 ++++++-
 lib/_http_common.js                           |  1 +
 lib/_http_incoming.js                         | 13 +++++++--
 lib/_http_server.js                           |  6 ++++
 lib/http.js                                   |  3 +-
 ...http-request-join-authorization-headers.js | 29 +++++++++++++++++++
 7 files changed, 63 insertions(+), 4 deletions(-)
 create mode 100644 test/parallel/test-http-request-join-authorization-headers.js

diff --git a/doc/api/http.md b/doc/api/http.md
index 37bb05b53a8872..f4f047b0ccf95c 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -3182,6 +3182,10 @@ changes:
     a 400 (Bad Request) status code to any HTTP/1.1 request message
     that lacks a Host header (as mandated by the specification).
     **Default:** `true`.
+  * `joinAuthorizationHeaders` {boolean} It joins the field line values of
+    multiple `Authorization` headers in a request
+    with ` ,` instead of discarding the duplicates.
+    **Default:** `false`.
   * `ServerResponse` {http.ServerResponse} Specifies the `ServerResponse` class
     to be used. Useful for extending the original `ServerResponse`. **Default:**
     `ServerResponse`.
diff --git a/lib/_http_client.js b/lib/_http_client.js
index 79ed2c8bc9b2d3..b9dae341b4c57b 100644
--- a/lib/_http_client.js
+++ b/lib/_http_client.js
@@ -81,7 +81,7 @@ const {
   ERR_UNESCAPED_CHARACTERS
 } = codes;
 const {
-  validateInteger,
+  validateInteger, validateBoolean,
 } = require('internal/validators');
 const { getTimerDuration } = require('internal/timers');
 const {
@@ -97,6 +97,7 @@ const onClientRequestStartChannel = dc.channel('http.client.request.start');
 const onClientResponseFinishChannel = dc.channel('http.client.response.finish');
 
 const { addAbortSignal, finished } = require('stream');
+const console = require('console');
 
 let debug = require('internal/util/debuglog').debuglog('http', (fn) => {
   debug = fn;
@@ -229,6 +230,12 @@ function ClientRequest(input, options, cb) {
   }
   this.insecureHTTPParser = insecureHTTPParser;
 
+  if (options.joinAuthorizationHeaders !== undefined) {
+    validateBoolean(options.joinAuthorizationHeaders, 'options.joinAuthorizationHeaders');
+  }
+
+  this.joinAuthorizationHeaders = options.joinAuthorizationHeaders;
+
   this.path = options.path || '/';
   if (cb) {
     this.once('response', cb);
@@ -811,6 +818,8 @@ function tickOnSocket(req, socket) {
     parser.maxHeaderPairs = req.maxHeadersCount << 1;
   }
 
+  parser.joinAuthorizationHeaders = req.joinAuthorizationHeaders
+
   parser.onIncoming = parserOnIncomingClient;
   socket.on('error', socketErrorListener);
   socket.on('data', socketOnData);
diff --git a/lib/_http_common.js b/lib/_http_common.js
index 526901cb5f9681..0fdd721a8b07b2 100644
--- a/lib/_http_common.js
+++ b/lib/_http_common.js
@@ -94,6 +94,7 @@ function parserOnHeadersComplete(versionMajor, versionMinor, headers, method,
   incoming.httpVersionMajor = versionMajor;
   incoming.httpVersionMinor = versionMinor;
   incoming.httpVersion = `${versionMajor}.${versionMinor}`;
+  incoming.joinAuthorizationHeaders = socket && socket.server && socket.server.joinAuthorizationHeaders || parser.joinAuthorizationHeaders;
   incoming.url = url;
   incoming.upgrade = upgrade;
 
diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
index 950c8c6e08bbc9..b3397787f9b0eb 100644
--- a/lib/_http_incoming.js
+++ b/lib/_http_incoming.js
@@ -75,7 +75,7 @@ function IncomingMessage(socket) {
   this[kTrailers] = null;
   this[kTrailersCount] = 0;
   this.rawTrailers = [];
-
+  this.joinAuthorizationHeaders = false;
   this.aborted = false;
 
   this.upgrade = null;
@@ -115,7 +115,6 @@ ObjectDefineProperty(IncomingMessage.prototype, 'headers', {
 
       const src = this.rawHeaders;
       const dst = this[kHeaders];
-
       for (let n = 0; n < this[kHeadersCount]; n += 2) {
         this._addHeaderLine(src[n + 0], src[n + 1], dst);
       }
@@ -400,6 +399,16 @@ function _addHeaderLine(field, value, dest) {
     } else {
       dest['set-cookie'] = [value];
     }
+  } else if (this.joinAuthorizationHeaders && flag === 97) {
+    // RFC 9110 https://www.rfc-editor.org/rfc/rfc9110#section-5.2
+    // https://github.com/nodejs/node/issues/45699
+    // allow authorization multiple fields
+    // Make a delimited list
+    if (typeof dest[field] === 'string') {
+      dest[field] += ', ' + value;
+    } else {
+      dest[field] = value;
+    }
   } else if (dest[field] === undefined) {
     // Drop duplicates
     dest[field] = value;
diff --git a/lib/_http_server.js b/lib/_http_server.js
index 3c85d343bda53c..dcbd7e49a2ba48 100644
--- a/lib/_http_server.js
+++ b/lib/_http_server.js
@@ -481,6 +481,12 @@ function storeHTTPOptions(options) {
   } else {
     this.requireHostHeader = true;
   }
+
+  const joinAuthorizationHeaders = options.joinAuthorizationHeaders;
+  if (joinAuthorizationHeaders !== undefined) {
+    validateBoolean(joinAuthorizationHeaders, 'options.joinAuthorizationHeaders');
+  }
+  this.joinAuthorizationHeaders = joinAuthorizationHeaders;
 }
 
 function setupConnectionsTracking(server) {
diff --git a/lib/http.js b/lib/http.js
index 9e99048a0b6504..ea11cb10eaf14c 100644
--- a/lib/http.js
+++ b/lib/http.js
@@ -52,7 +52,8 @@ let maxHeaderSize;
  *   ServerResponse?: ServerResponse;
  *   insecureHTTPParser?: boolean;
  *   maxHeaderSize?: number;
- *   requireHostHeader?: boolean
+ *   requireHostHeader?: boolean;
+ *   joinAuthorizationHeaders?: boolean;
  *   }} [opts]
  * @param {Function} [requestListener]
  * @returns {Server}
diff --git a/test/parallel/test-http-request-join-authorization-headers.js b/test/parallel/test-http-request-join-authorization-headers.js
new file mode 100644
index 00000000000000..9cab60c73f4bce
--- /dev/null
+++ b/test/parallel/test-http-request-join-authorization-headers.js
@@ -0,0 +1,29 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const http = require('http');
+
+{
+  const server = http.createServer({
+    requireHostHeader: false,
+    joinAuthorizationHeaders: true
+  }, common.mustCall((req, res) => {
+    assert.strictEqual(req.headers.authorization, '1, 2');
+    res.writeHead(200, ['authorization', '3', 'authorization', '4']);
+    res.end();
+  }));
+
+  server.listen(0, common.mustCall(() => {
+    http.get({
+      port: server.address().port,
+      headers: ['authorization', '1', 'authorization', '2'],
+      joinAuthorizationHeaders: true
+    }, (res) => {
+      assert.strictEqual(res.statusCode, 200);
+      assert.strictEqual(res.headers.authorization, '3, 4');
+      res.resume().on('end', common.mustCall(() => {
+        server.close();
+      }));
+    });
+  }));
+}

From 2386a245a5ec24a46ceac143d77c9fc6e5ff9fec Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Thu, 29 Dec 2022 00:05:45 +0100
Subject: [PATCH 06/12] http: more doc

---
 doc/api/http.md     | 5 +++++
 lib/_http_client.js | 3 +--
 lib/_http_common.js | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/doc/api/http.md b/doc/api/http.md
index f4f047b0ccf95c..dd9051d70b1101 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -2454,6 +2454,8 @@ header name:
 * `set-cookie` is always an array. Duplicates are added to the array.
 * For duplicate `cookie` headers, the values are joined together with `; `.
 * For all other headers, the values are joined together with `, `.
+* To allow duplicate values of `authorization` see the option
+  `joinAuthorizationHeaders` in [`http.request()`][]
 
 ### `message.headersDistinct`
 
@@ -3441,6 +3443,9 @@ changes:
   * `uniqueHeaders` {Array} A list of request headers that should be sent
     only once. If the header's value is an array, the items will be joined
     using `; `.
+  * `joinAuthorizationHeaders` {boolean} It joins the field line values of
+    multiple `Authorization` headers in a request
+    with ` ,` instead of discarding the duplicates.
 * `callback` {Function}
 * Returns: {http.ClientRequest}
 
diff --git a/lib/_http_client.js b/lib/_http_client.js
index b9dae341b4c57b..aaff50961db67f 100644
--- a/lib/_http_client.js
+++ b/lib/_http_client.js
@@ -97,7 +97,6 @@ const onClientRequestStartChannel = dc.channel('http.client.request.start');
 const onClientResponseFinishChannel = dc.channel('http.client.response.finish');
 
 const { addAbortSignal, finished } = require('stream');
-const console = require('console');
 
 let debug = require('internal/util/debuglog').debuglog('http', (fn) => {
   debug = fn;
@@ -818,7 +817,7 @@ function tickOnSocket(req, socket) {
     parser.maxHeaderPairs = req.maxHeadersCount << 1;
   }
 
-  parser.joinAuthorizationHeaders = req.joinAuthorizationHeaders
+  parser.joinAuthorizationHeaders = req.joinAuthorizationHeaders;
 
   parser.onIncoming = parserOnIncomingClient;
   socket.on('error', socketErrorListener);
diff --git a/lib/_http_common.js b/lib/_http_common.js
index 0fdd721a8b07b2..e0b98b5ce62af1 100644
--- a/lib/_http_common.js
+++ b/lib/_http_common.js
@@ -94,7 +94,9 @@ function parserOnHeadersComplete(versionMajor, versionMinor, headers, method,
   incoming.httpVersionMajor = versionMajor;
   incoming.httpVersionMinor = versionMinor;
   incoming.httpVersion = `${versionMajor}.${versionMinor}`;
-  incoming.joinAuthorizationHeaders = socket && socket.server && socket.server.joinAuthorizationHeaders || parser.joinAuthorizationHeaders;
+  incoming.joinAuthorizationHeaders = (socket && socket.server &&
+                                       socket.server.joinAuthorizationHeaders) ||
+                                       parser.joinAuthorizationHeaders;
   incoming.url = url;
   incoming.upgrade = upgrade;
 

From fdc2c0012b2f6717bed05d2142573c8de650938c Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Thu, 29 Dec 2022 09:56:20 +0100
Subject: [PATCH 07/12] http: generic join header

---
 doc/api/http.md                                | 18 ++++++++++--------
 lib/_http_client.js                            |  8 ++++----
 lib/_http_common.js                            |  6 +++---
 lib/_http_incoming.js                          |  4 ++--
 lib/_http_server.js                            |  8 ++++----
 lib/http.js                                    |  2 +-
 ...-http-request-join-authorization-headers.js |  4 ++--
 7 files changed, 26 insertions(+), 24 deletions(-)

diff --git a/doc/api/http.md b/doc/api/http.md
index dd9051d70b1101..da939b8a677caa 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -2451,11 +2451,12 @@ header name:
   `etag`, `expires`, `from`, `host`, `if-modified-since`, `if-unmodified-since`,
   `last-modified`, `location`, `max-forwards`, `proxy-authorization`, `referer`,
   `retry-after`, `server`, or `user-agent` are discarded.
+  To allow duplicate values of the headers listed above to be joined,
+  use the option `joinDuplicateHeaders` in [`http.request()`][]
+  and [`http.createServer()`][].
 * `set-cookie` is always an array. Duplicates are added to the array.
 * For duplicate `cookie` headers, the values are joined together with `; `.
 * For all other headers, the values are joined together with `, `.
-* To allow duplicate values of `authorization` see the option
-  `joinAuthorizationHeaders` in [`http.request()`][]
 
 ### `message.headersDistinct`
 
@@ -3184,9 +3185,9 @@ changes:
     a 400 (Bad Request) status code to any HTTP/1.1 request message
     that lacks a Host header (as mandated by the specification).
     **Default:** `true`.
-  * `joinAuthorizationHeaders` {boolean} It joins the field line values of
-    multiple `Authorization` headers in a request
-    with ` ,` instead of discarding the duplicates.
+  * `joinDuplicateHeaders` {boolean} It joins the field line values of multiple
+    headers in a request with ` ,` instead of discarding the duplicates.
+    See [`message.headers`][] for more information.
     **Default:** `false`.
   * `ServerResponse` {http.ServerResponse} Specifies the `ServerResponse` class
     to be used. Useful for extending the original `ServerResponse`. **Default:**
@@ -3443,9 +3444,9 @@ changes:
   * `uniqueHeaders` {Array} A list of request headers that should be sent
     only once. If the header's value is an array, the items will be joined
     using `; `.
-  * `joinAuthorizationHeaders` {boolean} It joins the field line values of
-    multiple `Authorization` headers in a request
-    with ` ,` instead of discarding the duplicates.
+  * `joinDuplicateHeaders` {boolean} It joins the field line values of
+    multiple headers in a request with ` ,` instead of discarding
+    the duplicates. See [`message.headers`][] for more information.
 * `callback` {Function}
 * Returns: {http.ClientRequest}
 
@@ -3759,6 +3760,7 @@ Set the maximum number of idle HTTP parsers. **Default:** `1000`.
 [`http.IncomingMessage`]: #class-httpincomingmessage
 [`http.ServerResponse`]: #class-httpserverresponse
 [`http.Server`]: #class-httpserver
+[`http.createServer()`]: #httpcreateserveroptions-requestlistener
 [`http.get()`]: #httpgetoptions-callback
 [`http.globalAgent`]: #httpglobalagent
 [`http.request()`]: #httprequestoptions-callback
diff --git a/lib/_http_client.js b/lib/_http_client.js
index aaff50961db67f..8169f60f792fa1 100644
--- a/lib/_http_client.js
+++ b/lib/_http_client.js
@@ -229,11 +229,11 @@ function ClientRequest(input, options, cb) {
   }
   this.insecureHTTPParser = insecureHTTPParser;
 
-  if (options.joinAuthorizationHeaders !== undefined) {
-    validateBoolean(options.joinAuthorizationHeaders, 'options.joinAuthorizationHeaders');
+  if (options.joinDuplicateHeaders !== undefined) {
+    validateBoolean(options.joinDuplicateHeaders, 'options.joinDuplicateHeaders');
   }
 
-  this.joinAuthorizationHeaders = options.joinAuthorizationHeaders;
+  this.joinDuplicateHeaders = options.joinDuplicateHeaders;
 
   this.path = options.path || '/';
   if (cb) {
@@ -817,7 +817,7 @@ function tickOnSocket(req, socket) {
     parser.maxHeaderPairs = req.maxHeadersCount << 1;
   }
 
-  parser.joinAuthorizationHeaders = req.joinAuthorizationHeaders;
+  parser.joinDuplicateHeaders = req.joinDuplicateHeaders;
 
   parser.onIncoming = parserOnIncomingClient;
   socket.on('error', socketErrorListener);
diff --git a/lib/_http_common.js b/lib/_http_common.js
index e0b98b5ce62af1..f8d3793031efa3 100644
--- a/lib/_http_common.js
+++ b/lib/_http_common.js
@@ -94,9 +94,9 @@ function parserOnHeadersComplete(versionMajor, versionMinor, headers, method,
   incoming.httpVersionMajor = versionMajor;
   incoming.httpVersionMinor = versionMinor;
   incoming.httpVersion = `${versionMajor}.${versionMinor}`;
-  incoming.joinAuthorizationHeaders = (socket && socket.server &&
-                                       socket.server.joinAuthorizationHeaders) ||
-                                       parser.joinAuthorizationHeaders;
+  incoming.joinDuplicateHeaders = (socket && socket.server &&
+                                       socket.server.joinDuplicateHeaders) ||
+                                       parser.joinDuplicateHeaders;
   incoming.url = url;
   incoming.upgrade = upgrade;
 
diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
index b3397787f9b0eb..003a872d237570 100644
--- a/lib/_http_incoming.js
+++ b/lib/_http_incoming.js
@@ -75,7 +75,7 @@ function IncomingMessage(socket) {
   this[kTrailers] = null;
   this[kTrailersCount] = 0;
   this.rawTrailers = [];
-  this.joinAuthorizationHeaders = false;
+  this.joinDuplicateHeaders = false;
   this.aborted = false;
 
   this.upgrade = null;
@@ -399,7 +399,7 @@ function _addHeaderLine(field, value, dest) {
     } else {
       dest['set-cookie'] = [value];
     }
-  } else if (this.joinAuthorizationHeaders && flag === 97) {
+  } else if (this.joinDuplicateHeaders) {
     // RFC 9110 https://www.rfc-editor.org/rfc/rfc9110#section-5.2
     // https://github.com/nodejs/node/issues/45699
     // allow authorization multiple fields
diff --git a/lib/_http_server.js b/lib/_http_server.js
index dcbd7e49a2ba48..83f1c25acb1ae3 100644
--- a/lib/_http_server.js
+++ b/lib/_http_server.js
@@ -482,11 +482,11 @@ function storeHTTPOptions(options) {
     this.requireHostHeader = true;
   }
 
-  const joinAuthorizationHeaders = options.joinAuthorizationHeaders;
-  if (joinAuthorizationHeaders !== undefined) {
-    validateBoolean(joinAuthorizationHeaders, 'options.joinAuthorizationHeaders');
+  const joinDuplicateHeaders = options.joinDuplicateHeaders;
+  if (joinDuplicateHeaders !== undefined) {
+    validateBoolean(joinDuplicateHeaders, 'options.joinDuplicateHeaders');
   }
-  this.joinAuthorizationHeaders = joinAuthorizationHeaders;
+  this.joinDuplicateHeaders = joinDuplicateHeaders;
 }
 
 function setupConnectionsTracking(server) {
diff --git a/lib/http.js b/lib/http.js
index ea11cb10eaf14c..abfac1939df43a 100644
--- a/lib/http.js
+++ b/lib/http.js
@@ -53,7 +53,7 @@ let maxHeaderSize;
  *   insecureHTTPParser?: boolean;
  *   maxHeaderSize?: number;
  *   requireHostHeader?: boolean;
- *   joinAuthorizationHeaders?: boolean;
+ *   joinDuplicateHeaders?: boolean;
  *   }} [opts]
  * @param {Function} [requestListener]
  * @returns {Server}
diff --git a/test/parallel/test-http-request-join-authorization-headers.js b/test/parallel/test-http-request-join-authorization-headers.js
index 9cab60c73f4bce..45274783603d5e 100644
--- a/test/parallel/test-http-request-join-authorization-headers.js
+++ b/test/parallel/test-http-request-join-authorization-headers.js
@@ -6,7 +6,7 @@ const http = require('http');
 {
   const server = http.createServer({
     requireHostHeader: false,
-    joinAuthorizationHeaders: true
+    joinDuplicateHeaders: true
   }, common.mustCall((req, res) => {
     assert.strictEqual(req.headers.authorization, '1, 2');
     res.writeHead(200, ['authorization', '3', 'authorization', '4']);
@@ -17,7 +17,7 @@ const http = require('http');
     http.get({
       port: server.address().port,
       headers: ['authorization', '1', 'authorization', '2'],
-      joinAuthorizationHeaders: true
+      joinDuplicateHeaders: true
     }, (res) => {
       assert.strictEqual(res.statusCode, 200);
       assert.strictEqual(res.headers.authorization, '3, 4');

From 2d52bd8c167bb531e034aee229f907daec84e34f Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Thu, 29 Dec 2022 10:07:56 +0100
Subject: [PATCH 08/12] http: default value

---
 doc/api/http.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/api/http.md b/doc/api/http.md
index da939b8a677caa..b16dbedc05c9ac 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -3447,6 +3447,7 @@ changes:
   * `joinDuplicateHeaders` {boolean} It joins the field line values of
     multiple headers in a request with ` ,` instead of discarding
     the duplicates. See [`message.headers`][] for more information.
+    **Default:** `false`.
 * `callback` {Function}
 * Returns: {http.ClientRequest}
 

From 8e54765fba90e70e25242b725906bfb05b1e8b15 Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Thu, 29 Dec 2022 11:03:42 +0100
Subject: [PATCH 09/12] http: more tests

---
 ...http-request-join-authorization-headers.js | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/test/parallel/test-http-request-join-authorization-headers.js b/test/parallel/test-http-request-join-authorization-headers.js
index 45274783603d5e..56d99ddb0bb4b7 100644
--- a/test/parallel/test-http-request-join-authorization-headers.js
+++ b/test/parallel/test-http-request-join-authorization-headers.js
@@ -9,6 +9,34 @@ const http = require('http');
     joinDuplicateHeaders: true
   }, common.mustCall((req, res) => {
     assert.strictEqual(req.headers.authorization, '1, 2');
+    assert.strictEqual(req.headers.cookie, 'foo; bar');
+    res.writeHead(200, ['authorization', '3', 'authorization', '4', 'cookie', 'foo', 'cookie', 'bar']);
+    res.end();
+  }));
+
+  server.listen(0, common.mustCall(() => {
+    http.get({
+      port: server.address().port,
+      headers: ['authorization', '1', 'authorization', '2', 'cookie', 'foo', 'cookie', 'bar'],
+      joinDuplicateHeaders: true
+    }, (res) => {
+      assert.strictEqual(res.statusCode, 200);
+      assert.strictEqual(res.headers.authorization, '3, 4');
+      assert.strictEqual(res.headers.cookie, 'foo; bar');
+      res.resume().on('end', common.mustCall(() => {
+        server.close();
+      }));
+    });
+  }));
+}
+
+{
+  // Server joinDuplicateHeaders false
+  const server = http.createServer({
+    requireHostHeader: false,
+    joinDuplicateHeaders: false
+  }, common.mustCall((req, res) => {
+    assert.strictEqual(req.headers.authorization, '1'); // non joined value
     res.writeHead(200, ['authorization', '3', 'authorization', '4']);
     res.end();
   }));
@@ -27,3 +55,29 @@ const http = require('http');
     });
   }));
 }
+
+{
+  // Client joinDuplicateHeaders false
+  const server = http.createServer({
+    requireHostHeader: false,
+    joinDuplicateHeaders: true
+  }, common.mustCall((req, res) => {
+    assert.strictEqual(req.headers.authorization, '1, 2');
+    res.writeHead(200, ['authorization', '3', 'authorization', '4']);
+    res.end();
+  }));
+
+  server.listen(0, common.mustCall(() => {
+    http.get({
+      port: server.address().port,
+      headers: ['authorization', '1', 'authorization', '2'],
+      joinDuplicateHeaders: false
+    }, (res) => {
+      assert.strictEqual(res.statusCode, 200);
+      assert.strictEqual(res.headers.authorization, '3'); // non joined value
+      res.resume().on('end', common.mustCall(() => {
+        server.close();
+      }));
+    });
+  }));
+}

From e948db07db6d330a2c74506268a30721194c0836 Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Sun, 1 Jan 2023 15:45:42 +0100
Subject: [PATCH 10/12] http: rfc compliace

---
 doc/api/http.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/api/http.md b/doc/api/http.md
index b16dbedc05c9ac..d502a5cab887af 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -2453,7 +2453,8 @@ header name:
   `retry-after`, `server`, or `user-agent` are discarded.
   To allow duplicate values of the headers listed above to be joined,
   use the option `joinDuplicateHeaders` in [`http.request()`][]
-  and [`http.createServer()`][].
+  and [`http.createServer()`][]. See RFC 9110 Section 5.3 for more
+  information.
 * `set-cookie` is always an array. Duplicates are added to the array.
 * For duplicate `cookie` headers, the values are joined together with `; `.
 * For all other headers, the values are joined together with `, `.

From dddf33a425b43e3f5c1cf2d4b03c940b78022243 Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Sun, 1 Jan 2023 19:17:54 +0100
Subject: [PATCH 11/12] http: nits

---
 doc/api/http.md       | 9 ++++++++-
 lib/_http_client.js   | 3 ++-
 lib/_http_common.js   | 5 ++---
 lib/_http_incoming.js | 7 ++++---
 4 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/doc/api/http.md b/doc/api/http.md
index d502a5cab887af..b660a0158e2f7a 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -2422,6 +2422,13 @@ as an argument to any listeners on the event.
 <!-- YAML
 added: v0.1.5
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/45982
+    description: >-
+     The `joinDuplicateHeaders` option in the `http.request()`
+     and `http.createServer()` functions ensures that duplicate
+     headers are not discarded, but rather combined using a
+     comma separator, in accordance with RFC 9110 Section 5.3.
   - version: v15.1.0
     pr-url: https://github.com/nodejs/node/pull/35281
     description: >-
@@ -3446,7 +3453,7 @@ changes:
     only once. If the header's value is an array, the items will be joined
     using `; `.
   * `joinDuplicateHeaders` {boolean} It joins the field line values of
-    multiple headers in a request with ` ,` instead of discarding
+    multiple headers in a request with `, ` instead of discarding
     the duplicates. See [`message.headers`][] for more information.
     **Default:** `false`.
 * `callback` {Function}
diff --git a/lib/_http_client.js b/lib/_http_client.js
index 8169f60f792fa1..22d102b59754eb 100644
--- a/lib/_http_client.js
+++ b/lib/_http_client.js
@@ -81,7 +81,8 @@ const {
   ERR_UNESCAPED_CHARACTERS
 } = codes;
 const {
-  validateInteger, validateBoolean,
+  validateInteger,
+  validateBoolean,
 } = require('internal/validators');
 const { getTimerDuration } = require('internal/timers');
 const {
diff --git a/lib/_http_common.js b/lib/_http_common.js
index f8d3793031efa3..017bf4fdba4151 100644
--- a/lib/_http_common.js
+++ b/lib/_http_common.js
@@ -94,9 +94,8 @@ function parserOnHeadersComplete(versionMajor, versionMinor, headers, method,
   incoming.httpVersionMajor = versionMajor;
   incoming.httpVersionMinor = versionMinor;
   incoming.httpVersion = `${versionMajor}.${versionMinor}`;
-  incoming.joinDuplicateHeaders = (socket && socket.server &&
-                                       socket.server.joinDuplicateHeaders) ||
-                                       parser.joinDuplicateHeaders;
+  incoming.joinDuplicateHeaders = socket?.server?.joinDuplicateHeaders ||
+                                  parser.joinDuplicateHeaders;
   incoming.url = url;
   incoming.upgrade = upgrade;
 
diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
index 003a872d237570..45477dd3e132d3 100644
--- a/lib/_http_incoming.js
+++ b/lib/_http_incoming.js
@@ -115,6 +115,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'headers', {
 
       const src = this.rawHeaders;
       const dst = this[kHeaders];
+
       for (let n = 0; n < this[kHeadersCount]; n += 2) {
         this._addHeaderLine(src[n + 0], src[n + 1], dst);
       }
@@ -404,10 +405,10 @@ function _addHeaderLine(field, value, dest) {
     // https://github.com/nodejs/node/issues/45699
     // allow authorization multiple fields
     // Make a delimited list
-    if (typeof dest[field] === 'string') {
-      dest[field] += ', ' + value;
-    } else {
+    if (dest[field] === undefined) {
       dest[field] = value;
+    } else {
+      dest[field] += ', ' + value;
     }
   } else if (dest[field] === undefined) {
     // Drop duplicates

From cae19591d92223515c172a751cab6b302b6e500a Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Sun, 1 Jan 2023 19:51:31 +0100
Subject: [PATCH 12/12] doc: typo

---
 doc/api/http.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/api/http.md b/doc/api/http.md
index b660a0158e2f7a..e7d276b7587aa4 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -3194,7 +3194,7 @@ changes:
     that lacks a Host header (as mandated by the specification).
     **Default:** `true`.
   * `joinDuplicateHeaders` {boolean} It joins the field line values of multiple
-    headers in a request with ` ,` instead of discarding the duplicates.
+    headers in a request with `, ` instead of discarding the duplicates.
     See [`message.headers`][] for more information.
     **Default:** `false`.
   * `ServerResponse` {http.ServerResponse} Specifies the `ServerResponse` class