Are HTTP headers case-sensitive?

HTTP header names are case-insensitive. RFC 9110 §5.1 states this directly, so Content-Type, content-type, and CONTENT-TYPE all refer to the same header and a compliant server must treat them identically. HTTP/2 goes further and requires names to be sent in lowercase on the wire, but standard libraries handle that for you. Header values are a different matter and are case-sensitive unless the value’s own specification says otherwise. ETags, cookie values, and credentials like Authorization: Bearer <token> must be transmitted exactly as issued, while values defined as tokens by RFC 9110 (for example, keep-alive or text/html) are case-insensitive. One practical caveat for scraping: some anti-bot fingerprinting systems flag requests whose header casing does not match the browser they claim to be, so let your HTTP client emit its default casing instead of overriding it.