starlette.datastructures.Headers(raw=...) membership check fails when raw header names aren’t lowercased (ASGI interop)

[folex]

Hi! We ran into an interop issue when constructing starlette.datastructures.Headers from a raw header list. If the raw list contains header names that are not lowercased bytes (e.g. b"Content-Encoding"), the membership check via in does not work, even though Headers.__repr__ shows the header present.

This can lead to incorrect behavior in middleware that relies on "content-encoding" in headers (e.g. GZipMiddleware potentially double-compressing a response).

Reproduction

from starlette.datastructures import Headers

rh = [
    (b"Content-Type", b"text/plain; version=0.0.4; charset=utf-8"),
    (b"Content-Encoding", b"gzip"),
]
hs = Headers(raw=rh)

print(hs)
# Headers({'Content-Type': 'text/plain; version=0.0.4; charset=utf-8', 'Content-Encoding': 'gzip'})

"content-encoding" in hs
# False

"Content-Encoding" in hs
# False

Expected

• At least one of the membership checks above should be True, or
• Headers should normalize raw header names to lowercase internally, or
• Headers(raw=...) should validate/document that raw keys must already be lowercased.

Actual

• Both membership checks return False.

Notes / context

ASGI specifies header names should be lowercase bytes. In our case, prometheus-client produced raw headers with capitalized names. Starlette preserves raw as-is, while __contains__ lowercases the lookup key—so membership checks can never match.

These headers are produced by prometheus_client's make_asgi_app: https://github.com/prometheus/client_python/blob/e1cdc203b1cf5f15c7b9a64d79fccc7907a62ca3/prometheus_client/asgi.py#L8

Thanks for taking a look—happy to provide additional details!

[cookesan]

This is a real edge case, but it comes from passing non-ASGI-normalized raw headers.

Headers(raw=...) preserves the raw byte pairs. Lookups lowercase the requested header name, so membership works when raw names are ASGI-style lower-case bytes. If raw contains b"Content-Encoding" instead of b"content-encoding", the lookup can miss it.

If the raw headers come from ASGI, they should already be lower-case. If they come from another source, normalize them before constructing Headers: