Test all Vary Headers

Author: barryvdh

src/CorsService.php

@@ -211,8 +211,20 @@ public function varyHeader(Response $response, $header): Response
     {
         if (!$response->headers->has('Vary')) {
             $response->headers->set('Vary', $header);
-        } elseif (!in_array($header, explode(', ', $response->headers->get('Vary')))) {
-            $response->headers->set('Vary', $response->headers->get('Vary') . ', ' . $header);
+        } else {
+            $varyHeaders = $response->headers->all('Vary');
+            $existing = [];
+            foreach ($varyHeaders as $value) {
+                $existing = array_merge($existing, explode(', ', $value));
+            }
+
+            if (!in_array($header, $existing)) {
+                if (count($varyHeaders) < 2) {
+                    $response->headers->set('Vary', $response->headers->get('Vary') . ', ' . $header);
+                } else {
+                    $response->headers->set('Vary', $header, false);
+                }
+            }
         }
 
         return $response;

tests/CorsTest.php

@@ -271,6 +271,76 @@ public function it_appends_an_existing_vary_header()
         $this->assertEquals('Content-Type, Origin', $response->headers->get('Vary'));
     }
 
+
+    /**
+     * @test
+     * @see http://www.w3.org/TR/cors/index.html#resource-implementation
+     */
+    public function it_doesnt_append_an_existing_vary_header_when_exists()
+    {
+        $app      = $this->createStackedApp(
+            array(
+                'allowedOrigins' => ['*'],
+                'supportsCredentials' => true,
+            ),
+            array(
+                'Vary' => 'Content-Type, Origin'
+            )
+        );
+        $request  = $this->createValidActualRequest();
+
+        $response = $app->handle($request);
+
+        $this->assertTrue($response->headers->has('Vary'));
+        $this->assertEquals('Content-Type, Origin', $response->headers->get('Vary'));
+    }
+
+    /**
+     * @test
+     * @see http://www.w3.org/TR/cors/index.html#resource-implementation
+     */
+    public function it_appends_an_existing_vary_header_when_multiple()
+    {
+        $app      = $this->createStackedApp(
+            array(
+                'allowedOrigins' => ['*'],
+                'supportsCredentials' => true,
+            ),
+            array(
+                'Vary' => ['Content-Type', 'Referer'],
+            )
+        );
+        $request  = $this->createValidActualRequest();
+
+        $response = $app->handle($request);
+
+        $this->assertTrue($response->headers->has('Vary'));
+        $this->assertEquals(['Content-Type' ,'Referer', 'Origin'], $response->headers->all('Vary'));
+    }
+
+    /**
+     * @test
+     * @see http://www.w3.org/TR/cors/index.html#resource-implementation
+     */
+    public function it_doesnt_append_an_existing_vary_header_when_exists_multiple()
+    {
+        $app      = $this->createStackedApp(
+            array(
+                'allowedOrigins' => ['*'],
+                'supportsCredentials' => true,
+            ),
+            array(
+                'Vary' => ['Content-Type', 'Referer', 'Origin'],
+            )
+        );
+        $request  = $this->createValidActualRequest();
+
+        $response = $app->handle($request);
+
+        $this->assertTrue($response->headers->has('Vary'));
+        $this->assertEquals(['Content-Type' ,'Referer', 'Origin'], $response->headers->all('Vary'));
+    }
+
     /**
      * @test
      */