Playwright Header-Splitting Report: Validate HTTP Dates Across Proxy Browser Tests

An open issue filed in the Microsoft Playwright repository on September 12, 2026 reports that response.headersArray() may split a single header value at a comma in Firefox and WebKit. HTTP-date values contain a comma by design, so fields such as Date and Last-Modified can appear as two entries even though the server sent one. The report also describes a macOS WebKit case involving Set-Cookie with an Expires date.

This is an open user report, not a maintainer-confirmed defect or released fix. The reproduction used Playwright 1.64.0-next on macOS arm64 and compared Chromium, Firefox and WebKit. Teams should validate their own versions before changing production logic.

Internal research source: Microsoft Playwright repository, Issue 42687, “headersArray() splits single header values on commas on Firefox and WebKit, corrupting every HTTP-date header,” opened September 12, 2026.

Why this matters to proxy-backed collection

Browser automation often records response metadata for freshness checks, cache validation, signed evidence and session handling. If one header becomes two values, a collector may parse an invalid date, mark fresh content as stale, duplicate an event or lose a cookie expiry attribute.

A proxy adds another variable because it may forward, normalize or append headers. Without a direct control and raw origin evidence, teams can blame the proxy for a client-library transformation—or miss a genuine route transformation.

Build an owned header fixture

Use an HTTPS endpoint you control. Return deterministic values for:

• Date;
• Last-Modified;
• Expires;
• Retry-After in date form;
• one list-valued header where comma separation is valid;
• two separate Set-Cookie fields, including one Expires attribute.

Also return a random body challenge and request identifier. Store expected raw header pairs at the origin so the browser output can be compared with what was actually sent.

Run the cross-browser route matrix

Keep browser build, Playwright version, target, locale, timezone and request headers fixed. Repeat each cell. Do not use one browser's output as the only source of truth.

Compare structure before parsing dates

For each field, record the number of entries, original order, case-insensitive name, complete value digest and parse result. A valid single HTTP-date must remain one semantic value. Joining every array entry with commas is not a safe universal workaround because genuinely repeated and list-valued headers follow different rules.

Treat header categories separately:

• single-valued date fields must preserve the complete date;
• list-valued fields can contain comma-separated members;
• Set-Cookie must preserve independent cookie fields and commas inside Expires;
• unknown fields should not be reconstructed without a documented rule.

Separate proxy and client transformations

Use four comparisons:

1. origin raw pairs versus direct Chromium;
2. origin raw pairs versus direct Firefox and WebKit;
3. direct browser versus the same browser through a proxy;
4. proxy capture at an authorized gateway versus browser output.

If direct Firefox and WebKit differ from the origin while the wire response is unchanged, the client path is the leading hypothesis. If only one proxy route changes raw evidence, investigate that route. Reproduce before assigning cause.

Protect cache and freshness decisions

Do not commit a timestamp derived from a malformed header. Validate that the value parses as a complete HTTP date, falls within an expected range and matches the raw-value digest. Keep origin receipt time as a separate field; it is not a replacement for server Date.

If Last-Modified drives conditional requests, verify the next If-Modified-Since request sends the complete value. A truncated weekday or missing comma can silently disable efficient cache validation.

Protect cookies and sessions

Cookie expiry is higher risk because a corrupted Expires attribute can change session lifetime. Compare the browser cookie store with raw Set-Cookie fields. Never log cookie values; record only cookie name hashes, expiry, domain, path, secure flags and the parsing outcome.

Combine this with the TLS trust-profile isolation test and session stickiness test. Header correctness does not prove sessions are isolated across exits.

Temporary handling before a confirmed fix

Prefer an API that preserves the required value in your tested runtime, and keep a raw-header or origin-side control for critical metadata. Scope any workaround to known single-valued date fields. Add browser- and version-specific regression tests, then remove the workaround only after a released version passes them.

Do not concatenate arbitrary header arrays, rewrite third-party cookies or weaken validation. A workaround that produces plausible but false metadata is worse than rejecting an uncertain record.

Release checklist

• Public copy identifies the report as open and unconfirmed.
• Raw origin header pairs are available for the fixture.
• Chromium, Firefox and WebKit are compared directly and through proxies.
• Single-valued dates remain one semantic value.
• List-valued headers and Set-Cookie use separate rules.
• Cache validators send complete dates.
• Cookie values are never logged.
• Unknown or malformed metadata fails closed.
• Browser version is stored with every test.
• The workaround has an explicit removal test.

FAQ

Does this prove a proxy modified the header?

No. The report concerns a Playwright representation path. Direct, raw-origin and proxy comparisons are required before attributing a transformation.

Can I join all duplicate values with a comma?

No. Header fields have different combination rules, and Set-Cookie requires special handling. Reconstruct only fields with a documented grammar.

Are response bodies affected?

The report focuses on header representation. Validate body integrity separately with the proxy response integrity test.

Should production parsing be changed now?

Only after reproducing the behavior in your exact browser and Playwright versions. Add a narrow, reversible workaround with regression coverage.

Compliance note

Run tests only against systems and proxy routes you own or are authorized to assess. Minimize retained headers, never expose cookies or credentials, and follow privacy, contractual and platform requirements. Metadata validation must not be used to bypass access controls.