Parse repeated Tornado headers as separate values (fixes #1109)

AUTHORS.rst

@@ -60,3 +60,4 @@ Contributors (chronological)
 * Tumuer `@un4gt <https://github.com/un4gt>`_
 * Marat Sharafutdinov `@decaz <https://github.com/decaz>`_
 * Felix Engelmann `@dorthrithil <https://github.com/dorthrithil>`_
+* X6M-Work `@X6M-Work <https://github.com/X6M-Work>`_

CHANGELOG.rst

@@ -34,6 +34,12 @@ Other changes:
 * Drop support for aiohttp < 3.13.0 (:pr:`1023`).
 * Drop support for marshmallow < 4.0.0 (:pr:`1023`).
 
+Bug fixes:
+
+* `TornadoParser <webargs.tornadoparser.TornadoParser>`: Repeated headers are
+  parsed as separate values for multi-value fields such as ``List``, instead of
+  being split into characters of the comma-joined header (:issue:`1109`).
+
 8.7.1 (2025-10-29)
 ******************
 

src/webargs/tornadoparser.py

@@ -23,7 +23,7 @@ def get(self, args):
 import tornado.concurrent
 import tornado.web
 from tornado.escape import _unicode
-from tornado.httputil import HTTPServerRequest
+from tornado.httputil import HTTPHeaders, HTTPServerRequest
 
 from webargs import core
 from webargs.multidictproxy import MultiDictProxy
@@ -55,6 +55,10 @@ def __getitem__(self, key: str) -> typing.Any:
             if value is core.missing:
                 return core.missing
             if key in self.multiple_keys:
+                # HTTPHeaders.get() joins repeated headers with commas,
+                # get_list() returns each value separately
+                if isinstance(self.data, HTTPHeaders):
+                    value = self.data.get_list(key)
                 return [
                     _unicode(v) if isinstance(v, (str, bytes)) else v for v in value
                 ]

tests/test_tornadoparser.py

@@ -171,6 +171,21 @@ def test_it_should_get_multiple_values(self):
         result = parser.load_headers(request, author_schema)
         assert result["works"] == ["Prometheus Bound", "Prometheus Unbound"]
 
+    def test_it_should_get_repeated_headers_as_multiple_values(self):
+        headers = tornado.httputil.HTTPHeaders()
+        headers.add("works", "Prometheus Bound")
+        headers.add("works", "Prometheus Unbound")
+        request = make_request(headers=headers)
+        result = parser.load_headers(request, author_schema)
+        assert result["works"] == ["Prometheus Bound", "Prometheus Unbound"]
+
+    def test_it_should_get_a_single_header_as_one_value_list(self):
+        headers = tornado.httputil.HTTPHeaders()
+        headers.add("works", "Prometheus Bound")
+        request = make_request(headers=headers)
+        result = parser.load_headers(request, author_schema)
+        assert result["works"] == ["Prometheus Bound"]
+
     def test_it_should_return_missing_if_not_present(self):
         request = make_request()
         result = parser.load_headers(request, author_schema)