This is one of those bugs that can be surprisingly hard to track down, because the code looks correct at first glance. The key point here is to check the raw request, not just what the framework reports — proxies, middleware, and duplicate set calls can all add a second copy before the request reaches the server. Logging the headers at each step, and comparing what the client sent with what the server received, usually narrows it down quickly. It is also worth checking whether the header is being set in more than one place, such as both application code and a server configuration.
Daniel Collins
This is one of those bugs that can be surprisingly hard to track down, because the code looks correct at first glance. The key point here is to check the raw request, not just what the framework reports — proxies, middleware, and duplicate set calls can all add a second copy before the request reaches the server. Logging the headers at each step, and comparing what the client sent with what the server received, usually narrows it down quickly. It is also worth checking whether the header is being set in more than one place, such as both application code and a server configuration.