KEMBAR78
Add missing `Origin` to the `Vary` header value when CORS enabled by joseluisq · Pull Request #534 · static-web-server/static-web-server · GitHub
Skip to content

Add missing Origin to the Vary header value when CORS enabled #534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Mar 27, 2025
Merged

Add missing Origin to the Vary header value when CORS enabled #534

merged 2 commits into from
Mar 27, 2025

Conversation

@joseluisq
Copy link
Collaborator

@joseluisq joseluisq commented Mar 24, 2025 •
edited
Loading

Description

This PR includes the missing Origin header to the resulting Vary header value when the CORS feature is enabled according to https://fetch.spec.whatwg.org/#example-vary-origin.

Related Issue

It resolves #533

Motivation and Context

How Has This Been Tested?

static-web-server -p 8788 -d ./docker/public/ -g trace -z true '-c=*'

Before

$ curl -I -H "Origin: http://devel.local:8788" http://localhost:8788/assets/main.js
# HTTP/1.1 200 OK
# content-length: 52
# content-type: text/javascript
# accept-ranges: bytes
# last-modified: Mon, 10 Feb 2025 21:00:47 GMT
# access-control-allow-headers: content-type, origin, authorization
# access-control-expose-headers: origin, content-type
# access-control-allow-methods: OPTIONS, GET, HEAD
# access-control-allow-origin: http://devel.local:8788
# vary: accept-encoding
# cache-control: public, max-age=31536000
# date: Mon, 24 Mar 2025 03:20:15 GMT

After

$ curl -I -H "Origin: http://devel.local:8788" http://localhost:8788/assets/main.js
# HTTP/1.1 200 OK
# content-length: 52
# content-type: text/javascript
# accept-ranges: bytes
# last-modified: Mon, 10 Feb 2025 21:00:47 GMT
# access-control-allow-headers: content-type, origin, authorization
# access-control-expose-headers: origin, content-type
# access-control-allow-methods: GET, HEAD, OPTIONS
# access-control-allow-origin: http://devel.local:8788
# vary: origin,accept-encoding
# cache-control: public, max-age=31536000
# date: Mon, 24 Mar 2025 03:22:44 GM

Preflight request

$ curl http://localhost:8788/assets/main.js \
    -I -X OPTIONS \
    -H "Access-Control-Request-Method: HEAD" \
    -H "Access-Control-Request-Headers: content-type" \
    -H "Origin: http://localhost:8787"
# HTTP/1.1 204 No Content
# vary: origin,accept-encoding
# accept-ranges: bytes
# access-control-allow-headers: origin, content-type, authorization
# access-control-expose-headers: content-type, origin
# access-control-allow-methods: HEAD, OPTIONS, GET
# access-control-allow-origin: http://localhost:8787
# cache-control: public, max-age=31536000
# date: Mon, 24 Mar 2025 03:36:53 GMT

Without CORS:

$ static-web-server -p 8788 -d ./docker/public/ -g trace

$ curl -I -H "Origin: http://devel.local:8788" http://localhost:8788/assets/main.js
# HTTP/1.1 200 OK
# content-length: 52
# content-type: text/javascript
# accept-ranges: bytes
# last-modified: Mon, 10 Feb 2025 21:00:47 GMT
# vary: accept-encoding
# cache-control: public, max-age=31536000
# date: Mon, 24 Mar 2025 03:27:08 GMT

Screenshots (if appropriate):

@joseluisq joseluisq added v2 v2 release bugfix This is PR fixes a bug labels Mar 24, 2025
@semanticdiff-com
Copy link

semanticdiff-com bot commented Mar 24, 2025 •
edited
Loading

Review changes with  SemanticDiff

Changed Files
File Status
  src/testing.rs  47% smaller
  tests/compression.rs  39% smaller
  tests/rewrites.rs  38% smaller
  tests/compression_static.rs  36% smaller
  tests/handler.rs  26% smaller
  tests/redirects.rs  24% smaller
  src/compression_static.rs  10% smaller
  tests/cors.rs  5% smaller
  src/compression.rs  0% smaller
  src/cors.rs  0% smaller

@joseluisq joseluisq added this to the v2.36.1 milestone Mar 24, 2025
@joseluisq joseluisq force-pushed the fix-cors-response-missing-origin-in-vary-header branch from f7f2f54 to 09c2bbe Compare March 27, 2025 03:51
@joseluisq joseluisq force-pushed the fix-cors-response-missing-origin-in-vary-header branch from 09c2bbe to baecce8 Compare March 27, 2025 16:54
@joseluisq joseluisq merged commit 2a74187 into master Mar 27, 2025
36 checks passed
@joseluisq joseluisq deleted the fix-cors-response-missing-origin-in-vary-header branch March 27, 2025 17:10
@joseluisq joseluisq mentioned this pull request Mar 27, 2025
Closed
1 task
joseluisq added a commit that referenced this pull request Mar 28, 2025
@joseluisq
fix: add missing Origin to the Vary header value when CORS enabled (
5fbd0c5 
#534)

reference: https://fetch.spec.whatwg.org/#example-vary-origin
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bugfix This is PR fixes a bug v2 v2 release

Projects

None yet

Milestone

v2.36.1

Development

Successfully merging this pull request may close these issues.

Vary header should include Origin header when cors is enabled

1 participant

@joseluisq