fix(static): always add vary: accept-encoding for compressed assets

[paulcrussell]

🔗 Linked issue

#3077

❓ Type of change

• 📖 Documentation (updates to the documentation, readme, or JSdoc annotations)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

The build process produces compressed public assets based on nitro option 'compressPublicAssets' if those assets are present then it means the response may 'Vary' based on Accept-Encoding request header.

Currently the 'Vary' based on Accept-Encoding request header is included only if the Accept-Encoding request header exists. This introduces a problem that the Vary header can get omitted if the client sends a request without Accept-Encoding header. This would cause the server to respond with a uncompressed file that would then be cached in shared caches and served to everyone.

Shifting the logic so that the header is always sent if the server is optionally configured to return uncompressed, gz or br public assets removes the possibility for a client to poison the cache for all.

Resolves #3077

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

[paulcrussell]

@pi0 I've updated the commit to fix the failing tests.

[pi0]

We are already iterating on encoding variations, on match, we can alternatively also append the header instead of additional loop

[paulcrussell]

Hi @pi0 the fix here is to change the dependency of the Vary response header.
current: dependent on the request accept-encoding request header
proposed: dependent on whether the application has the capability to Vary the response

So it needs to iterate all possible encodings (i.e. gz or .br) and validate if at least one encoding is enabled. In this case the server is capable of Varying the response so the Vary header can be sent.

[pi0]

Please let me double check this, we can land fix in next releases.