How can I check response header names with case sensitivity?

Short answer: you can't match header names case-sensitively, and that's by design. You can match header values exactly.

Why header names are case-insensitive

The HTTP spec defines header field names as case-insensitive, so Content-Type, content-type, and CONTENT-TYPE all refer to the same header. Middleware, web servers, CDNs, and HTTP libraries routinely normalize the casing as requests flow through, which means the name you set in your application is rarely the exact name your client sees.

Oh Dear follows the spec: we match header names case-insensitively and header values exactly.

So if your uptime check expects X-Custom-Header: Production, we will accept:

• X-Custom-Header: Production
• x-custom-header: Production
• X-CUSTOM-HEADER: Production

But we will not accept X-Custom-Header: production (wrong casing on the value).

Working around it when you need header-name guarantees

Sometimes you do need to verify that a specific middleware or piece of infrastructure is producing the exact header you expect, and you want to fail loudly if the casing changes. Since we can't check the name directly, the workaround is to emit a canary header from the same code path.

Have your middleware set an additional header like x-ohdear-verify: <anything> whenever it processes a response. Configure the Oh Dear uptime check to assert that header is present (a simple "contains" check on the value works fine).

If the canary stops appearing, you know the middleware broke, which tells you the real header-transformation logic also broke, without us needing to verify the casing directly.