I'll start by saying this is my fault. :( The HTTPRequest.getHeader method will return any environment variable, not just headers. I expect this was a lazy way to handle the odd-ball headers, content-type and content-length (envirnment variables CONTENT_TYPE and CONTENT_LENGTH), which don't have an "HTTP_" prefix in the environment. I think this implementation is rather lame. What's worse, it has a test, testHeader that actually tests the lamosity. I suggest we switch to a tighter behavior. I'd be wildly surprised and disappointed if any apps depended on the lose behavior. If no one objects, I'll file an issue. (I don't think there's anything urgent about this.) Jim -- Jim Fulton Zope Corporation