No, the order of the header fields doesn’t matter:
The order in which header fields with differing field names are received is not significant. However, it is "good practice" to send general-header fields first, followed by request-header or response- header fields, and ending with the entity-header fields.
Only if you’re sending multiple fields of the same name. Then the field values are treated like they would appear in one list:
Multiple message-header fields with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list [i.e., #(values)
]. It MUST be possible to combine the multiple header fields into one "field-name: field-value" pair, without changing the semantics of the message, by appending each subsequent field-value to the first, each separated by a comma. The order in which header fields with the same field-name are received is therefore significant to the interpretation of the combined field value, and thus a proxy MUST NOT change the order of these field values when a message is forwarded.
So the following:
Cache-Control: private
Cache-Control: must-revalidate
would be equivalent to:
Cache-Control: private, must-revalidate
And here it depends on the definition of the header field (here Cache-Control) if the order does matter.