Can Content Negotiation values be sent out of order?

Question

I'm determining a user's language/locale from the Accept-Language header, and was wondering if they could ever be passed out of order. I've written a php sort function to make sure they are in descending order, but if it's unnecessary, I'd like to remove it.

Example of proper order:

Accept-Language: fr-ca, fr; q=0.8, en-ca; q=0.6, en-us; q=0.4, en; q=0.2

Example of improper order:

Accept-Language: fr-ca, en; q=0.2, en-ca; q=0.6, en-us; q=0.4, fr; q=0.8

Answer 1

Yes, content negotiation values can be sent out of order.

HTTP/1.1 Specification doesn't define anything about ordering of values in Accept-* headers. So the order doesn't have any meaning for client's preference.

Answer 2

The sections about Accept-Language in RFC 2068 (from 1997) and RFC 2616 (from 1999) both said nothing whatsoever about the order in which languages should be listed.

The more recent RFC 7231 (from 2014) had a paragraph of commentary on the matter, and that same paragraph is preserved in the even more recent RFC 9110 (from 2022). Section 12.5.4. Accept-Language says:

Note that some recipients treat the order in which language tags are listed as an indication of descending priority, particularly for tags that are assigned equal quality values (no value is the same as q=1). However, this behavior cannot be relied upon. For consistency and to maximize interoperability, many user agents assign each language tag a unique quality value while also listing them in order of decreasing quality. Additional discussion of language priority lists can be found in Section 2.3 of [RFC4647].

Some of the qualifiers included here (note: "particularly for tags that are assigned equal quality" and "many user agents") are eyebrow-raising. Their inclusion heavily implies that the 2014 authors were aware of servers that assumed languages were listed in descending order of priority regardless of priority values, and also of clients that did not send languages in descending order of priority. That seems unfortunate, since those two behaviours are of course not compatible with each other!

The RFC makes no comment on how clients should order these lists, perhaps not wanting to dictate how clients behave on the basis of a few aberrant servers. But what servers should do is very clear: you should sort the languages received by their priority values, and not rely on the client having sent them to you in descending order, because the spec does not require them to do so.