Skip to content

[Bug]: Double header value (X-Content-Type-Options) in response, make HTTPToolKit useless #785

@nextco

Description

@nextco

Has this been reported before?

  • I have checked for existing reports of this issue

Repro steps

Hello, recently (in the last two weeks 1.20.1) I noticed a HTTP response integrity checker was added.

However, in our professional work, we often encounter situations where responses don't always comply with RFCs.

I have an application that responds with two X-Content-Type-Options header values.
Like:

HTTP/2 200 OK
Date: Wed, 27 Aug 2025 15:45:34 GMT

X-Content-Type-Options: nosniff
...
X-Xss-Protection: 0
X-Content-Type-Options: nosniff

Image

Expected: I want to have control of the responses, I don't care if they come malformed, also burp handle responses as expected.

I try to apply a rule, to remove headers from "Transform & Mock" but looks HTTP Toolkit block before.

Image

It is important to note that before this "integrity change" I was able to work fine.

Logs
last-run.log

How often does this bug happen?

Every time

The desktop OS you're using

Mac OS 15.3

Details of other apps/devices

APIs

Error screenshot

Image

Any other info?

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions