Are HTTP headers case-sensitive?
Header names are not case sensitive.
From RFC 2616 - "Hypertext Transfer Protocol -- HTTP/1.1", Section 4.2, "Message Headers":
Each header field consists of a name followed by a colon (":") and the field value. Field names are case-insensitive.
The updating RFC 7230 does not list any changes from RFC 2616 at this part.
HTTP header names are case-insensitive, according to RFC 2616:
4.2:
Each header field consists of a name followed by a colon (":") and the field value. Field names are case-insensitive.
(Field values may or may not be case-sensitive.)
If you trust the major browsers to abide by this, you're all set.
BTW, unlike most of HTTP, methods (verbs) are case sensitive:
5.1.1 Method
The Method token indicates the method to be performed on the
resource identified by the Request-URI. The method is case-sensitive.Method = "OPTIONS" ; Section 9.2 | "GET" ; Section 9.3 | "HEAD" ; Section 9.4 | "POST" ; Section 9.5 | "PUT" ; Section 9.6 | "DELETE" ; Section 9.7 | "TRACE" ; Section 9.8 | "CONNECT" ; Section 9.9 | extension-method extension-method = token
tldr; both HTTP/1.1 and HTTP/2 headers are case-insensitive.
According to RFC 7230 (HTTP/1.1):
Each header field consists of a case-insensitive field name followed by a colon (":"), optional leading whitespace, the field value, and optional trailing whitespace.
https://www.rfc-editor.org/rfc/rfc7230#section-3.2
Also, RFC 7540 (HTTP/2):
Just as in HTTP/1.x, header field names are strings of ASCII
characters that are compared in a case-insensitive fashion.
https://www.rfc-editor.org/rfc/rfc7540#section-8.1.2