fix(@angular/ssr): ensure unique values in redirect response Vary header

Refactors the `createRedirectResponse` function to use a `Set` for constructing the `Vary` header. This ensures that `X-Forwarded-Prefix` is always present exactly once, and that existing `Vary` values from provided headers are correctly parsed, deduplicated, and preserved.

Updates the associated unit tests to reflect the new header order and verify the deduplication logic.

Author: alan-agius4

packages/angular/ssr/src/utils/redirect.ts

@@ -50,13 +50,18 @@ export function createRedirectResponse(
     );
   }
 
-  let vary = resHeaders.get('Vary') ?? '';
-  if (vary) {
-    vary += ', ';
+  // Ensure unique values for Vary header
+  const varyArray = resHeaders.get('Vary')?.split(',') ?? [];
+  const varySet = new Set(['X-Forwarded-Prefix']);
+  for (const vary of varyArray) {
+    const value = vary.trim();
+
+    if (value) {
+      varySet.add(value);
+    }
   }
-  vary += 'X-Forwarded-Prefix';
 
-  resHeaders.set('Vary', vary);
+  resHeaders.set('Vary', [...varySet].join(', '));
   resHeaders.set('Location', location);
 
   return new Response(null, {

packages/angular/ssr/test/utils/redirect_spec.ts

@@ -36,7 +36,14 @@ describe('Redirect Utils', () => {
         'Vary': 'Host',
       });
       expect(response.headers.get('Location')).toBe('/home');
-      expect(response.headers.get('Vary')).toBe('Host, X-Forwarded-Prefix');
+      expect(response.headers.get('Vary')).toBe('X-Forwarded-Prefix, Host');
+    });
+
+    it('should NOT add duplicate X-Forwarded-Prefix if already present in Vary header', () => {
+      const response = createRedirectResponse('/home', 302, {
+        'Vary': 'X-Forwarded-Prefix, Host',
+      });
+      expect(response.headers.get('Vary')).toBe('X-Forwarded-Prefix, Host');
     });
 
     it('should warn if Location header is provided in extra headers in dev mode', () => {