diff --git a/packages/angular/ssr/src/utils/redirect.ts b/packages/angular/ssr/src/utils/redirect.ts index 3da6a0232bd8..79fb10f424dc 100644 --- a/packages/angular/ssr/src/utils/redirect.ts +++ b/packages/angular/ssr/src/utils/redirect.ts @@ -50,13 +50,18 @@ export function createRedirectResponse( ); } - let vary = resHeaders.get('Vary') ?? ''; - if (vary) { - vary += ', '; + // Ensure unique values for Vary header + const varyArray = resHeaders.get('Vary')?.split(',') ?? []; + const varySet = new Set(['X-Forwarded-Prefix']); + for (const vary of varyArray) { + const value = vary.trim(); + + if (value) { + varySet.add(value); + } } - vary += 'X-Forwarded-Prefix'; - resHeaders.set('Vary', vary); + resHeaders.set('Vary', [...varySet].join(', ')); resHeaders.set('Location', location); return new Response(null, { diff --git a/packages/angular/ssr/test/utils/redirect_spec.ts b/packages/angular/ssr/test/utils/redirect_spec.ts index bddbb81e2723..b26edd458ac3 100644 --- a/packages/angular/ssr/test/utils/redirect_spec.ts +++ b/packages/angular/ssr/test/utils/redirect_spec.ts @@ -36,7 +36,14 @@ describe('Redirect Utils', () => { 'Vary': 'Host', }); expect(response.headers.get('Location')).toBe('/home'); - expect(response.headers.get('Vary')).toBe('Host, X-Forwarded-Prefix'); + expect(response.headers.get('Vary')).toBe('X-Forwarded-Prefix, Host'); + }); + + it('should NOT add duplicate X-Forwarded-Prefix if already present in Vary header', () => { + const response = createRedirectResponse('/home', 302, { + 'Vary': 'X-Forwarded-Prefix, Host', + }); + expect(response.headers.get('Vary')).toBe('X-Forwarded-Prefix, Host'); }); it('should warn if Location header is provided in extra headers in dev mode', () => {