From 693d48b9eb965c4a479e137eea157eb1943b40a9 Mon Sep 17 00:00:00 2001
From: Ruben Verborgh <ruben@verborgh.org>
Date: Wed, 20 Jan 2021 18:18:55 +0100
Subject: [PATCH] feat: Set Vary header.

---
 config/presets/middleware.json      |  4 ++++
 test/integration/Middleware.test.ts | 21 +++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/config/presets/middleware.json b/config/presets/middleware.json
index 24d7de715..e1aa24a0e 100644
--- a/config/presets/middleware.json
+++ b/config/presets/middleware.json
@@ -25,6 +25,10 @@
         {
           "@type": "HeaderHandler",
           "HeaderHandler:_headers": [
+            {
+              "HeaderHandler:_headers_key": "Vary",
+              "HeaderHandler:_headers_value": "Accept,Authorization,Origin"
+            },
             {
               "HeaderHandler:_headers_key": "X-Powered-By",
               "HeaderHandler:_headers_value": "Community Solid Server"
diff --git a/test/integration/Middleware.test.ts b/test/integration/Middleware.test.ts
index 7398acd26..ad73836ad 100644
--- a/test/integration/Middleware.test.ts
+++ b/test/integration/Middleware.test.ts
@@ -34,6 +34,27 @@ describe('An Express server with middleware', (): void => {
     server.close();
   });
 
+  it('sets a Vary header containing Accept.', async(): Promise<void> => {
+    const res = await request(server).get('/');
+    expect(res.header).toEqual(expect.objectContaining({
+      vary: expect.stringMatching(/(^|,)\s*Accept\s*(,|$)/iu),
+    }));
+  });
+
+  it('sets a Vary header containing Authorization.', async(): Promise<void> => {
+    const res = await request(server).get('/');
+    expect(res.header).toEqual(expect.objectContaining({
+      vary: expect.stringMatching(/(^|,)\s*Authorization\s*(,|$)/iu),
+    }));
+  });
+
+  it('sets a Vary header containing Origin.', async(): Promise<void> => {
+    const res = await request(server).get('/');
+    expect(res.header).toEqual(expect.objectContaining({
+      vary: expect.stringMatching(/(^|,)\s*Origin\s*(,|$)/iu),
+    }));
+  });
+
   it('sends server identification in the X-Powered-By header.', async(): Promise<void> => {
     const res = await request(server).get('/');
     expect(res.header).toEqual(expect.objectContaining({