attempt to fix multiple header issue

framework/CHANGELOG.md

@@ -50,6 +50,7 @@ Yii Framework 2 Change Log
 - Bug #3817: `yii\rbac\PhpManager::getChildren()` returns null instead of expected empty array (qiangxue)
 - Bug #3843: Fixed Menu bug when using `template` with `encodeLabel` => false (creocoder, umneeq)
 - Bug #3863: Fixed incorrect js selector for `\yii\widgets\ActiveForm::errorSummaryCssClass` when it contains multiple classes (creocoder, umneeq)
+- Bug #3893: Headers did not overwrite default setting by webserver (cebe)
 - Bug #3909: `Html::to()` should not prefix base URL to URLs that already contain scheme (qiangxue)
 - Bug #3934: yii.handleAction() in yii.js does not correctly detect if a hyperlink contains useful URL or not (joni-jones, qiangxue)
 - Bug #3968: Messages logged in shutdown functions are not handled (qiangxue)

framework/web/HeaderCollection.php

@@ -28,6 +28,7 @@ class HeaderCollection extends Object implements \IteratorAggregate, \ArrayAcces
      */
     private $_headers = [];
 
+
     /**
      * Returns an iterator for traversing the headers in the collection.
      * This method is required by the SPL interface `IteratorAggregate`.

framework/web/Response.php

@@ -296,7 +296,6 @@ class Response extends \yii\base\Response
         if ($this->_headers === null) {
             $this->_headers = new HeaderCollection;
         }
-
         return $this->_headers;
     }
 
@@ -346,8 +345,11 @@ class Response extends \yii\base\Response
             $headers = $this->getHeaders();
             foreach ($headers as $name => $values) {
                 $name = str_replace(' ', '-', ucwords(str_replace('-', ' ', $name)));
+                // set replace for first occurance of header but false afterwards to allow multiple
+                $replace = true;
                 foreach ($values as $value) {
-                    header("$name: $value", false);
+                    header("$name: $value", $replace);
+                    $replace = false;
                 }
             }
         }