Parse HTTP Connection Headers as Comma-Separated Tokens

These values are not competing spellings of a single mode:

Connection: Upgrade
Connection: keep-alive, Upgrade

The second lists two connection options. HTTP defines Connection as a comma-separated list, with case-insensitive option names. Code comparing the whole value with the exact string Upgrade misses a valid list containing that option.

For ordinary forwarding, an HTTP intermediary parses the incoming field, removes fields named by its options, then removes Connection itself or replaces it with the intermediary's own control options for the onward connection.

Removing only a hard-coded Keep-Alive field is insufficient. A message can name another connection-specific field in the list, and that field must not leak into ordinary forwarding.

Supporting a protocol upgrade requires deliberate handling of the two connections and the new protocol. Blindly copying the incoming Upgrade headers is not an implementation of that handoff.

When one browser works and another fails, compare the actual field values on both sides of the intermediary. A difference between a single token and a two-token list can expose a parser error without requiring the browser to imitate another browser's exact formatting.

This concerns HTTP messages the proxy parses. An ordinary HTTPS CONNECT tunnel does not expose the encrypted website's Connection field to that proxy.