Duplicate Date headers in responses

[pierrejeambrun]

It appears that the flask application is interfering and adding it's own header too.

$ curl -I localhost:8080/auth/static/pin_32.png 
HTTP/1.1 200 OK
date: Thu, 12 Mar 2026 04:38:44 GMT <-- SENT BY uvicorn
server: uvicorn
content-disposition: inline; filename=pin_32.png
content-type: image/png
content-length: 1201
last-modified: Thu, 12 Mar 2026 01:43:44 GMT
cache-control: no-cache
etag: "1773279824.6871002-1201-1792155666"
date: Thu, 12 Mar 2026 04:38:44 GMT <-- DUPLICATE SENT BY FLASK
vary: Cookie

Committer

• I acknowledge that I am a maintainer/committer of the Apache Airflow project.

[saivarmaakireddy270-star]

It looks like the duplicate Date header is being introduced because it’s being set at multiple layers (application + server/proxy).

According to the HTTP spec, the Date header should only be set once, and most servers (Node.js, Nginx, etc.) automatically add it. If the application code also sets it manually, it results in duplication.

Suggested fix:

• Remove any manual setting of the Date header in the application code.
• Ensure that only one layer (preferably the server/proxy) is responsible for setting it.

For example, in Node.js:

// ❌ Avoid this
res.setHeader("Date", new Date().toUTCString());

If a reverse proxy like Nginx is involved, you can also hide the upstream header:

proxy_hide_header Date;

This should ensure only a single Date header is present in responses and resolve the issue.

[laurenhall1526-netizen]

Yeah, that makes sense. Looks like both Uvicorn and Flask are adding the Date header, which explains the duplication. We probably shouldn’t be setting it at the app layer at all—letting the server handle it should be enough. Might be worth checking where Flask is injecting it in this path. I can take a closer look if needed.

…

On Mon, Apr 6, 2026, 4:23 AM saivarmaakireddy270-star < ***@***.***> wrote: *saivarmaakireddy270-star* left a comment (apache/airflow#64678) <#64678 (comment)> It looks like the duplicate Date header is being introduced because it’s being set at multiple layers (application + server/proxy). According to the HTTP spec, the Date header should only be set once, and most servers (Node.js, Nginx, etc.) automatically add it. If the application code also sets it manually, it results in duplication. *Suggested fix:* - Remove any manual setting of the Date header in the application code. - Ensure that only one layer (preferably the server/proxy) is responsible for setting it. For example, in Node.js: // ❌ Avoid thisres.setHeader("Date", new Date().toUTCString()); If a reverse proxy like Nginx is involved, you can also hide the upstream header: proxy_hide_header Date; This should ensure only a single Date header is present in responses and resolve the issue. — Reply to this email directly, view it on GitHub <#64678 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/B7IHA43T6CXAC64F7PSKJRD4UNZQHAVCNFSM6AAAAACXL6QPQCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DCOJRGM3DOMRZGQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>