Fix vary header special-casing in CORS middleware

tower-http/CHANGELOG.md

@@ -14,9 +14,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## Fixed
 
 - **compression:** Skip compression for range requests ([#446])
+- **cors:** *Actually* keep Vary headers set by the inner service when setting response headers ([#473])
+  - Version 0.5.1 intended to ship this, but the implementation was buggy and didn't actually do anything
 
 [#399]: https://github.com/tower-rs/tower-http/pull/399
 [#446]: https://github.com/tower-rs/tower-http/pull/446
+[#473]: https://github.com/tower-rs/tower-http/pull/473
 
 # 0.5.1 (January 14, 2024)
 

tower-http/src/cors/mod.rs

@@ -74,6 +74,9 @@ mod expose_headers;
 mod max_age;
 mod vary;
 
+#[cfg(test)]
+mod tests;
+
 pub use self::{
     allow_credentials::AllowCredentials, allow_headers::AllowHeaders, allow_methods::AllowMethods,
     allow_origin::AllowOrigin, allow_private_network::AllowPrivateNetwork,
@@ -682,13 +685,15 @@ where
             KindProj::CorsCall { future, headers } => {
                 let mut response: Response<B> = ready!(future.poll(cx))?;
 
+                let response_headers = response.headers_mut();
+
                 // vary header can have multiple values, don't overwrite
                 // previously-set value(s).
                 if let Some(vary) = headers.remove(header::VARY) {
-                    headers.append(header::VARY, vary);
+                    response_headers.append(header::VARY, vary);
                 }
                 // extend will overwrite previous headers of remaining names
-                response.headers_mut().extend(headers.drain());
+                response_headers.extend(headers.drain());
 
                 Poll::Ready(Ok(response))
             }

tower-http/src/cors/tests.rs

@@ -1,7 +1,7 @@
 use std::convert::Infallible;
 
+use crate::test_helpers::Body;
 use http::{header, HeaderValue, Request, Response};
-use hyper::Body;
 use tower::{service_fn, util::ServiceExt, Layer};
 
 use crate::cors::CorsLayer;