Joining the response header values with a comma can be a trouble.

[wolfkang]

Hi,

The headers in the response that has the same key are joined with a comma.

      var headers = <String, String>{};
      response.headers.forEach((key, values) {
        headers[key] = values.join(',');
      });

This can make a problem when a value has a comma.

For example,

X-Some-Header: abc, def
X-Some-Header: ghi

The headers['X-Some-Header'] returns 'abc, def, ghi', and it's not possible to get the exact header values.

Especially the Set-Cookie header may have a comma in its value for the expires.
Let me show you some Set-Cookie headers(WordPress login cookies).

Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/
Set-Cookie: wordpress_blahblah=blah; path=/wp-content/plugins; HttpOnly
Set-Cookie: wordpress_blahblah=blah; path=/wp-admin; HttpOnly
Set-Cookie: wordpress_logged_in_blah=blah; path=/; HttpOnly
Set-Cookie: wordpress_user_sw_blah=+; expires=Thu, 16-Mar-2017 14:37:26 GMT; Max-Age=-31536000; path=/
Set-Cookie: wordpress_user_sw_secure_blah=+; expires=Thu, 16-Mar-2017 14:37:26 GMT; Max-Age=-31536000; path=/
Set-Cookie: wordpress_user_sw_olduser_blah=+; expires=Thu, 16-Mar-2017 14:37:26 GMT; Max-Age=-31536000; path=/

The headers['Set-Cookie'] returns a string value that concatenates those 'Set-Cookie' values like this.

wordpress_test_cookie=WP+Cookie+check; path=/,wordpress_blahblah=blah; path=/wp-content/plugins; HttpOnly,wordpress_blahblah=blah; path=/wp-admin; HttpOnly, wordpress_logged_in_blah=blah; path=/; HttpOnly, wordpress_user_sw_blah=+; expires=Thu, 16-Mar-2017 14:37:26 GMT; Max-Age=-31536000; path=/, wordpress_user_sw_secure_blah=+; expires=Thu, 16-Mar-2017 14:37:26 GMT; Max-Age=-31536000; path=/, wordpress_user_sw_olduser_blah=+; expires=Thu, 16-Mar-2017 14:37:26 GMT; Max-Age=-31536000; path=/

It's not simple to split the headers['Set-Cookie'] string value with a comma because of the comma in the expires.

So I don't think it's appropriate to join the header values with a comma.
It'd better either that the headers[] should return a list of values, or the glue string should not be a comma.

[nex3]

Working poorly with cookies is a known issue (#20). It's complicated by the fact that we don't have a good way of representing headers that supports people mostly accessing them as single key/value pairs but also supports accessing certain headers as multiple values.

[bobjackman]

Resurrecting an old issue here because even 5 years later, this is still cropping up. Incoming requests with multiple headers of the same name are joined with a comma and treated as a single header. We can't just split them back apart on commas because it's entirely possible to have a legitimate comma in the value of the header. #20 was linked above, but it's also still open. Is there a workaround for this?