Joshua Rogers a155ad55a3

httputil: add Vary: Accept-Encoding and fix compression headers (#17466) ...

- Emit `Vary: Accept-Encoding` in newCompressedResponseWriter so shared caches
  key responses by content-coding. This prevents cache poisoning and
  undecodable bytes when a compressed variant is cached and later served to a
  client that didn't advertise support. (RFC 9110 §12.5.5 "Vary";
  RFC 9111 §4.1 cache key & Vary)

- When selecting gzip/deflate, set `Content-Encoding` and delete any existing
  `Content-Length` so Go's net/http can frame the message correctly
  (chunked for HTTP/1.1; implicit for HTTP/2+). This avoids stale length
  mismatches and related proxy/client issues.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

2025-12-21 10:15:35 +01:00

..

compression_test.go

Update modernize (#17471)

2025-11-04 05:13:49 +00:00

compression.go

httputil: add Vary: Accept-Encoding and fix compression headers (#17466)

2025-12-21 10:15:35 +01:00

context.go

Apply analyzer "modernize" to the whole codebase

2025-08-27 14:48:41 +02:00

cors_test.go

util/httputil: Always add Vary header in SetCORS

2025-05-19 11:42:44 +02:00

cors.go

util/httputil: Always add Vary header in SetCORS

2025-05-19 11:42:44 +02:00