Check and save multiple Vary Headers (#108)

Test all Vary Headers for existing and don't replace when multiple

Author: barryvdh

src/CorsService.php

@@ -209,10 +209,13 @@ private function configureMaxAge(Response $response, Request $request)
 
     public function varyHeader(Response $response, $header): Response
     {
-        if (!$response->headers->has('Vary')) {
-            $response->headers->set('Vary', $header);
-        } elseif (!in_array($header, explode(', ', $response->headers->get('Vary')))) {
-            $response->headers->set('Vary', $response->headers->get('Vary') . ', ' . $header);
+        $vary = $response->getVary();
+        if (!in_array($header, $vary, true)) {
+            if (count($response->headers->all('Vary')) === 1) {
+                $response->setVary($response->headers->get('Vary') . ', ' . $header, true);
+            } else {
+                $response->setVary($header, false);
+            }
         }
 
         return $response;

tests/CorsTest.php

@@ -271,6 +271,76 @@ public function it_appends_an_existing_vary_header()
         $this->assertEquals('Content-Type, Origin', $response->headers->get('Vary'));
     }
 
+
+    /**
+     * @test
+     * @see http://www.w3.org/TR/cors/index.html#resource-implementation
+     */
+    public function it_doesnt_append_an_existing_vary_header_when_exists()
+    {
+        $app      = $this->createStackedApp(
+            array(
+                'allowedOrigins' => ['*'],
+                'supportsCredentials' => true,
+            ),
+            array(
+                'Vary' => 'Content-Type, Origin'
+            )
+        );
+        $request  = $this->createValidActualRequest();
+
+        $response = $app->handle($request);
+
+        $this->assertTrue($response->headers->has('Vary'));
+        $this->assertEquals('Content-Type, Origin', $response->headers->get('Vary'));
+    }
+
+    /**
+     * @test
+     * @see http://www.w3.org/TR/cors/index.html#resource-implementation
+     */
+    public function it_appends_an_existing_vary_header_when_multiple()
+    {
+        $app      = $this->createStackedApp(
+            array(
+                'allowedOrigins' => ['*'],
+                'supportsCredentials' => true,
+            ),
+            array(
+                'Vary' => ['Content-Type', 'Referer'],
+            )
+        );
+        $request  = $this->createValidActualRequest();
+
+        $response = $app->handle($request);
+
+        $this->assertTrue($response->headers->has('Vary'));
+        $this->assertEquals(['Content-Type' ,'Referer', 'Origin'], $response->headers->all('Vary'));
+    }
+
+    /**
+     * @test
+     * @see http://www.w3.org/TR/cors/index.html#resource-implementation
+     */
+    public function it_doesnt_append_an_existing_vary_header_when_exists_multiple()
+    {
+        $app      = $this->createStackedApp(
+            array(
+                'allowedOrigins' => ['*'],
+                'supportsCredentials' => true,
+            ),
+            array(
+                'Vary' => ['Content-Type', 'Referer', 'Origin'],
+            )
+        );
+        $request  = $this->createValidActualRequest();
+
+        $response = $app->handle($request);
+
+        $this->assertTrue($response->headers->has('Vary'));
+        $this->assertEquals(['Content-Type' ,'Referer', 'Origin'], $response->headers->all('Vary'));
+    }
+
     /**
      * @test
      */