When writing code that touches network addressing or HTTP headers, follow the exact protocol semantics rather than relying on convenient shortcuts, since subtle deviations break compatibility.
localhost can resolve to either 127.0.0.1 or ::1 depending on the system’s DNS/hosts configuration, so it is not a safe drop-in replacement for an explicit address:
# Avoid: relies on OS resolution, may bind to IPv6 instead of IPv4
host = 'localhost'
# Prefer: unambiguous
host = '127.0.0.1'
Vary, cookie names, content-disposition directives), always perform case-insensitive comparisons, since HTTP header field values are case-insensitive per spec:
# Avoid: case-sensitive check can miss existing entries
if 'Cookie' not in vary_headers:
...
# Prefer: case-insensitive check
if not any(h.lower() == 'cookie' for h in vary_headers):
...
Content-Disposition with both filename and filename*), preserve the order required by the spec/consuming clients instead of relying on dict iteration order or unpacking, since some clients depend on a specific directive order.Applying these rules prevents hard-to-diagnose networking and HTTP compatibility bugs across different browsers, OS resolvers, and client implementations.