Issue 1:
Using Flask 2.2.2, it seems that serving static resources leads to a duplicate Date HTTP Header field.

Here is a simple snippet easy to understand and to show how to reproduce:

from flask import Flask

app = Flask(__name__, static_url_path='/static')

@app.route('/', methods=['GET'])
def index():
return "Hello World"

app.run(port=30887)

Let's create a simple file inside static directory:

mkdir static
echo Hello > style.css

Now let's check HTTP headers:

maxux@workx0 ~ $ curl -I http://127.0.0.1:30887
HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.10.8
Date: Thu, 05 Jan 2023 21:53:31 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 11
Connection: close

All good here.

maxux@workx0 ~ $ curl -I http://127.0.0.1:30887/static/style.css
HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.10.8
Date: Thu, 05 Jan 2023 21:53:53 GMT <<<<
Content-Disposition: inline; filename=style.css
Content-Type: text/css; charset=utf-8
Content-Length: 6
Last-Modified: Thu, 05 Jan 2023 21:50:59 GMT
Cache-Control: no-cache
ETag: "1672955459.103843-6-1459357711"
Date: Thu, 05 Jan 2023 21:53:53 GMT <<<<
Connection: close

You can see Date header twice, for a static content response.

In addition, you can see python and Flask running version in the response as well to confirm running version.

This was spotted using nginx on front which complains (by a warning) that the header is duplicated.

Issue 2:
I ran into some warnings from nginx that my Flask server was generating duplicate Date headers, so I investigated.

Here's how to reproduce the situation:

app.py

from flask import Flask

app = Flask(__name__)

@app.route("/hello")
def hello_world():
return "Hello from a flask route!"

static/hello

Hello from static world.

$flask run

From another terminal run:

[root@vis cli]$ curl -v 'http://127.0.0.1:5000/hello'
* Trying 127.0.0.1:5000...
* Connected to 127.0.0.1 (127.0.0.1) port 5000 (#0)
> GET /hello HTTP/1.1
> Host: 127.0.0.1:5000
> User-Agent: curl/7.81.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: Werkzeug/2.2.2 Python/3.10.4
< Date: Wed, 10 Aug 2022 08:05:18 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 25
< Connection: close
<
* Closing connection 0
Hello from a flask route!
[root@vis cli]$ curl -v 'http://127.0.0.1:5000/static/hello'
* Trying 127.0.0.1:5000...
* Connected to 127.0.0.1 (127.0.0.1) port 5000 (#0)
> GET /static/hello HTTP/1.1
> Host: 127.0.0.1:5000
> User-Agent: curl/7.81.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: Werkzeug/2.2.2 Python/3.10.4
< Date: Wed, 10 Aug 2022 08:05:22 GMT
< Content-Disposition: inline; filename=hello
< Content-Type: application/octet-stream
< Content-Length: 25
< Last-Modified: Wed, 10 Aug 2022 08:00:56 GMT
< Cache-Control: no-cache
< Date: Wed, 10 Aug 2022 08:05:22 GMT
< Connection: close
<
Hello from static world.
* Closing connection 0

The -v turns on curl's verbose mode so that the request and response headers are printed.

Note how the headers of the static route have two Date fields, whereas the headers of the dynamic route only have one.

I dove into this some more and it seems that here's what is happening:

The http package always adds the date header, regardless of if it's a dynamic or static route.

/usr/lib/python3.10/http/server.py:493

self.send_header('Date', self.date_time_string())

The werkzeug package adds it again for a static request:

/usr/local/lib/python3.10/dist-packages/werkzeug/wrappers/response.py:802

self.headers["Date"] = http_date()

Obviously we should be doubling up on headers, right? What do you believe is the best fix for this?