title: Is it fine to use duplicate response header with same value?
body: <p>I found a response where duplicate headers are used by the application with the same value. Could anyone tell me that, Is it a good programming practice or those are used for security perspective or anything else?  </p>
  
  <pre>  
       HTTP/1.1 200 
       Accept-Ranges: bytes
       Cache-Control: no-cache, must-revalidate, private
       Content-Type: text/html
       Date: Mon, 20 Nov 2017 04:08:51 GMT
       Expires: 0
       Last-Modified: Thu, 16 Nov 2017 14:04:48 GMT
       Pragma: 
       Public-Key-Pins: pin-sha256="5w0XrTCAbsVO7vTngDViNHPutlvB43qYionPbpV2ky0=";  
       max-age=5184000; includeSubDomains;
       Server: Any
       Set-Cookie: ********************* httponly; secure; path=/
       Strict-Transport-Security: max-age=31536000 ; includeSubDomains
       Strict-Transport-Security: max-age=31536000; includeSubDomains
       X-Content-Type-Options: nosniff
       X-Content-Type-Options: nosniff
       X-Frame-Options: SAMEORIGIN
       X-Frame-Options: SAMEORIGIN
       X-XSS-Protection: 1; mode=block
       Content-Length: 559
       Connection: Close
  </pre>
  
  <p>This application is using duplicate X-Content-Type-Options header, Strict-Transport-Security, X-Frame-Options header with same values.</p>