fix(adaptor): preserve multi-value headers in net/http conversion

The header copy loops in handlerFunc and HTTPMiddleware called
Header.Set once per value, so repeated header lines (e.g. two
X-Forwarded-For entries) collapsed to the last value. Set the first
value — keeping replace semantics for keys already present on the
target request — and Add the rest. fasthttp's Add intentionally keeps
singleton semantics for Cookie/Content-Type/etc., so those behave as
before. New tests pin both conversion paths and fail against the old
code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5sm1LHEnvEVDRGsHWFfKK

Author: claude

middleware/adaptor/adaptor.go

@@ -210,9 +210,16 @@ func HTTPMiddleware(mw func(http.Handler) http.Handler) fiber.Handler {
 
 			// Remove all cookies before setting, see https://github.com/valyala/fasthttp/pull/1864
 			c.Request().Header.DelAllCookies()
-			for key, val := range r.Header {
-				for _, v := range val {
-					c.Request().Header.Set(key, v)
+			for key, vals := range r.Header {
+				if len(vals) == 0 {
+					continue
+				}
+				// Set replaces whatever the key held on the fiber request,
+				// then Add appends the remaining values so multi-value
+				// headers survive instead of collapsing to the last value.
+				c.Request().Header.Set(key, vals[0])
+				for _, v := range vals[1:] {
+					c.Request().Header.Add(key, v)
 				}
 			}
 			CopyContextToFiberContext(r.Context(), c.RequestCtx())
@@ -386,9 +393,19 @@ func handlerFunc(app *fiber.App, h ...fiber.Handler) http.HandlerFunc {
 		}
 		req.Header.SetProtocol(proto)
 
-		for key, val := range r.Header {
-			for _, v := range val {
-				req.Header.Set(key, v)
+		for key, vals := range r.Header {
+			if len(vals) == 0 {
+				continue
+			}
+			// Set replaces any value fasthttp derived while building the
+			// request, then Add appends the remaining values so multi-value
+			// headers (e.g. repeated X-Forwarded-For lines) survive instead
+			// of collapsing to the last value. fasthttp's Add keeps its own
+			// singleton semantics for Cookie/Content-Type/etc., which can
+			// only hold one value there by design.
+			req.Header.Set(key, vals[0])
+			for _, v := range vals[1:] {
+				req.Header.Add(key, v)
 			}
 		}
 

middleware/adaptor/adaptor_test.go

@@ -1834,3 +1834,57 @@ func Test_ResolveRemoteAddr_FastPathEquivalence(t *testing.T) {
 		require.Equal(t, want.String(), got.String(), "String() for %q", addr)
 	}
 }
+
+// Test_FiberHandlerFunc_MultiValueHeaders verifies repeated header lines on
+// the net/http request all reach the fiber handler instead of collapsing to
+// the last value.
+func Test_FiberHandlerFunc_MultiValueHeaders(t *testing.T) {
+	t.Parallel()
+
+	var got []string
+	h := FiberHandlerFunc(func(c fiber.Ctx) error {
+		for _, v := range c.Request().Header.PeekAll("X-Multi") {
+			got = append(got, string(v))
+		}
+		return c.SendStatus(fiber.StatusOK)
+	})
+
+	r := httptest.NewRequest(http.MethodGet, "/", http.NoBody)
+	r.Header.Add("X-Multi", "one")
+	r.Header.Add("X-Multi", "two")
+	r.Header.Add("X-Multi", "three")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	require.Equal(t, []string{"one", "two", "three"}, got)
+}
+
+// Test_HTTPMiddleware_MultiValueHeaders verifies multi-value headers added
+// by a wrapped net/http middleware survive the copy-back onto the fiber
+// request.
+func Test_HTTPMiddleware_MultiValueHeaders(t *testing.T) {
+	t.Parallel()
+
+	mw := func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			r.Header.Add("X-Multi", "one")
+			r.Header.Add("X-Multi", "two")
+			next.ServeHTTP(w, r)
+		})
+	}
+
+	app := fiber.New()
+	app.Use(HTTPMiddleware(mw))
+	var got []string
+	app.Get("/", func(c fiber.Ctx) error {
+		for _, v := range c.Request().Header.PeekAll("X-Multi") {
+			got = append(got, string(v))
+		}
+		return c.SendStatus(fiber.StatusOK)
+	})
+
+	resp, err := app.Test(httptest.NewRequest(http.MethodGet, "/", http.NoBody))
+	require.NoError(t, err)
+	require.Equal(t, fiber.StatusOK, resp.StatusCode)
+	require.Equal(t, []string{"one", "two"}, got)
+}