title: Why am I seeing duplicate headers with same values in HTTP response?
body: <p>When I recently curled my company's website, some headers appear to be duplicated in both names and values. For example, this is the full response from curl:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: nginx
  Date: Mon, 19 Dec 2016 15:54:37 GMT
  Content-Type: text/html; charset=utf-8
  Content-Length: 53272
  Connection: keep-alive
  Vary: Accept-Encoding
  Vary: Accept-Encoding
  X-Frame-Options: ALLOW-FROM https://policygenius1424796031.zendesk.com/
  ETag: W/"2515e7e2b57063c8029ea978bf98b6e7"
  Cache-Control: max-age=0, private, must-revalidate
  Set-Cookie: analytics_id=OW53dllLeGVPZ1YzR21vOVRvU1V5WjRBeklGNHdXeERpNVNNM3ZLd2djcnpBUjlnTzRWblFIYitHM0VtdWUzei0tN284NTV3RUVrRm9nVkhpTm1NZU5qQT09--b43227e963c8680e5b2984c13483e65ae67c8b6a; path=/; expires=Wed, 18 Jan 2017 15:54:37 -0000
  Set-Cookie: request_method=HEAD; path=/
  Set-Cookie: _policy_genius_session=bUVTYW5KU2FzQTh2bG44WEdvcExWK2d4NzJtNUlOSnpqUWhzL2tVSkhFTUNuODFWVkhmYU9mWVUySlpDbmlkdCttbVpZOXV0NHVYY3VWbFphYlA2S0tOdmROSFVMNUJ1QWNMMFpMcm5DZGEyTkdqSTBMMnNoTi9mMmJ2L01lSlRuSGhmMk8ydXBOYVNNcXA1Z1crWXUvelpvSDlYdWFZYjYxc0p2MGdPYnhNNm1FSFpDSFpYSU9Jb3F2UFhMQTVoTm12cXQ4bEdNMkpaVy95cWVQK094RXkwVmo5ZlE0UXdoMzA3LzJiQllkMW9jZS9xZmpiMEI0ZHFVMTNQSHlBbi0tSE51NGZyeEx2Nk95c3NxNWtHbjNhUT09--d1107337bb68f2861ffc6f081012441bd7554501; path=/; HttpOnly
  X-Request-Id: 4a812c77-719e-4163-a665-5059a2b1e3a6
  X-Runtime: 0.133390
  Vary: Origin
  Strict-Transport-Security: max-age=31536000
  Strict-Transport-Security: max-age=31536000
  </code></pre>
  
  <p>Notice <code>Strict-Transport-Security</code> and <code>Vary</code> are duplicates and have same values too. I am aware that it's ok to have duplicate header names with different values (<a href="https://stackoverflow.com/questions/4371328/are-duplicate-http-response-headers-acceptable">here</a>), but same values?</p>
  
  <p>Second part of the question: is anyone aware of negative effects of such duplication?</p>