Skip to content

fix: normalize vary header handling to prevent duplicate or omitted accept-encoding - #436

Merged
Tony133 merged 1 commit into
fastify:mainfrom
TalhaHunter101:fix/vary-header-normalization
Oct 13, 2026
Merged

Tony133 merged 1 commit into
fastify:mainfrom
TalhaHunter101:fix/vary-header-normalization

Conversation

@TalhaHunter101

Copy link
Copy Markdown
Contributor

Fixes #435

What kind of change does this PR introduce?

  • Bug fix

Description

Fixes setVaryHeader(reply) in index.js to correctly parse, normalize, and respect Vary headers:

  1. Case-Insensitive Normalization: Correctly recognizes existing accept-encoding regardless of casing (e.g. Vary: Accept-Encoding), preventing duplicate Vary: Accept-Encoding, accept-encoding headers.
  2. Exact Token Matching: Replaces naive substring search (.includes('accept-encoding')) with tokenization by commas and trimming whitespace. This prevents false positives when custom vary headers contain accept-encoding as a substring (e.g. x-accept-encoding), ensuring accept-encoding is legitimately appended.
  3. RFC 7231 Wildcard Compliance: Preserves Vary: * without incorrectly appending , accept-encoding.

Checklist

  • run npm run test
  • tests and/or benchmarks are included
  • commit message and code follows the Developer's Certification of Origin (DCO)
  • code follows the Code of Conduct

…ccept-encoding

Signed-off-by: Talha Shafeeq <talha.shafeeq.ts@gmail.com>

@mcollina mcollina left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@Tony133
Tony133 merged commit cadef6a into fastify:main Oct 13, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: Vary header normalization produces duplicate headers, substring false-positives, and violates RFC 7231 wildcard

3 participants