Network protocol correctness

When implementing networking-related code, be precise about protocol semantics rather than assuming convenient shortcuts behave identically to the spec-correct form. Two common pitfalls:

1. Addresses are not interchangeable with hostnames. localhost can resolve to both an IPv4 (127.0.0.1) and IPv6 (::1) address depending on the system’s resolver configuration, so it is not equivalent to binding explicitly to 127.0.0.1. When a specific address/interface is required (e.g. as a server bind default), use the literal IP rather than a hostname that may resolve ambiguously.

2. HTTP header names and values must be handled per spec, not by string equality assumptions. HTTP header names are case-insensitive, so any check for an existing header (e.g. detecting Cookie in a Vary header) must compare case-insensitively:

# Wrong: misses "cookie" or "COOKIE"
if 'Cookie' not in vary_headers:
    ...

# Correct: case-insensitive comparison
if not any(h.lower() == 'cookie' for h in vary_headers):
    ...

Likewise, when constructing headers with multiple parameters (e.g. Content-Disposition: filename / filename*), preserve the required ordering if older or stricter clients depend on it, and avoid relying on dict iteration order or APIs that don’t guarantee it. If strict ordering can’t be guaranteed through the available API, document the limitation or fall back to a simpler, safe header form (e.g. omit filename* when the filename is pure ASCII) rather than risk broken behavior on dependent clients.

In general: validate header/parameter handling against the actual protocol rules (case-insensitivity, required ordering, encoding) instead of treating strings naively, and prefer explicit, unambiguous values (literal IPs, explicit casing checks) over shortcuts that may differ across environments or client implementations.</description> </invoke>