fix(cors) set missing vary=origin

[marckhouzam]

When Access-Control-Allow-Origin is not *, the cors plugins normally
sets Vary=Origin. In the case where the plugin sets
Access-Control-Allow-Credentials the Vary=Origin is missing.

When that happens, the browser is told to uses its cache even when the
origin is different and then CORS fails by rejecting the non-matching
origin.

[thibaultcha]

@marckhouzam Thank you for the patch! Would you mind adding a test for this fix as well? We would need it in order for us to merge your PR. Thank you :)

[marckhouzam]

I'll give it a try.

[nijikokun]

We should review this further before allowing it to go through as there are implications when it isn't the origin. This blog post describes it:

https://www.fastly.com/blog/caching-cors

In fact vary could be it's own plugin or within some "browser cache" plugin.

[marckhouzam]

@nijikokun I read through the documentations you posted and it does look like the cache handling through the use of Vary could be improved. However, I am thinking that currently the CORS plugin has a bug in its handling of the cache when credentials=true and this PR has value in fixing that. What do you think?

With that in mind, I modified the CORS tests in a second commit. After looking at the existing tests for the cors plugin, I thought that adding a check in the different relevant tests for header Vary=Origin would cover the most ground. Since there was already a test where credentials=true, then checking for Vary=Origin in there shows that the test fails with the current master branch while it passes once my PR is applied.

I could add an is_nil() check for header Vary in all the other CORS tests if you would like.

Thanks

[marckhouzam]

Any comments on this updated PR?
Thanks!

[thibaultcha]

Thanks @marckhouzam, we'll have a look at it soon!

[thibaultcha]

LGTM. I agree with your statement @marckhouzam:

it does look like the cache handling through the use of Vary could be improved.

And furthermore:

However, I am thinking that currently the CORS plugin has a bug in its handling of the cache when credentials=true and this PR has value in fixing that.

Yes, this is entirely in the scope of this PR, and the point you previously raised can be addressed in a subsequent improvement (for which we would welcome another PR, of course!).

I could add an is_nil() check for header Vary in all the other CORS tests if you would like.

If you have time for it, that would be great! Approving it, but waiting on it before merging.

Thanks again!

[marckhouzam]

Thanks for approving!

Here are the extra changes to the tests. There was a couple Vary=Origin checks missing, and then I added the is_nil() for header Vary.

Thanks!

[thibaultcha]

@marckhouzam Thank you!

Btw, feel free to claim your contributor T-shirt now that your first PR has been merged :)

[marckhouzam]

Thanks for the quick turnaround!
It makes it a great experience to contribute to your project.