Hello Vercel Community,
I'm looking for technical clarification about how Vercel handles duplicate Authorization HTTP headers before requests reach a Next.js App Router application.
Background
We are developing a machine-to-machine authentication endpoint using Next.js and the Node.js runtime.
During isolated local testing with synthetic credentials (Next.js 16.3.1, Node.js 24.22.1), we observed the following:
- A request containing one valid Authorization header returned HTTP 204 as expected.
- A request containing a valid first Authorization header and an additional invalid Authorization header also returned HTTP 204.
- Two identical valid Authorization headers also resulted in HTTP 204.
Our investigation indicates that Node.js discards additional Authorization header values before NextRequest can inspect them.
This is not a confirmed Vercel vulnerability, and we have not reproduced the behavior on Vercel production.
Our security requirement
We want requests containing multiple raw Authorization headers to be rejected before successful authentication.
Questions
- Does Vercel reject duplicate Authorization headers at its public ingress, or normalize them before forwarding to the application?
- Can Vercel WAF detect multiple raw occurrences of the same Authorization header before normalization?
- Is strict duplicate-header rejection supported on the Hobby plan?
- Does the behavior differ between HTTP/1.1, HTTP/2 and HTTP/3?
- If Vercel cannot guarantee this rejection, what secure architecture would you recommend?
We have already reviewed Vercel's WAF documentation and contacted the support assistant, but have not received a definitive technical answer.
We are looking for documentation or guidance from someone familiar with Vercel's ingress implementation.
No production changes or tests are requested, and no real credentials or customer information are included.
Thank you!