### Summary Two kinds of Pages responses carry a body chosen from the request's `Accept-Encoding`, and neither lists `Accept-Encoding` in `Vary`: - **Static files and custom 404 pages.** `handleContentEncoding` serves the `.br` or `.gz` sibling of a file when one exists and the client accepts that encoding, and the file itself otherwise, and sets `Content-Encoding` ([`internal/serving/disk/helpers.go#L88-130`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/serving/disk/helpers.go#L88-130)). `serveFile` and `serveCustomFile` call it ([`reader.go#L224`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/serving/disk/reader.go#L224), [`reader.go#L278`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/serving/disk/reader.go#L278)), and sites without access control are served with `Cache-Control: max-age=600` ([`reader.go#L243-247`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/serving/disk/reader.go#L243-247)). - **Proxied artifacts.** Since !1177 the artifact proxy forwards the client's `Accept-Encoding` to the GitLab API and passes on the `Content-Encoding` of the answer ([`internal/artifact/artifact.go#L103`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/artifact/artifact.go#L103), [`artifact.go#L142-145`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/artifact/artifact.go#L142-145)). With the default Omnibus GitLab configuration, the NGINX in front of the API has `gzip on` and `gzip_vary on`, so an artifact of a compressible type and at least 250 bytes is answered gzip-compressed when the client accepts it. Pages copies the `Content-Encoding` but not the API's `Vary`, and public artifact responses are served with `Cache-Control: max-age=3600` ([`artifact.go#L159-163`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/artifact/artifact.go#L159-163)). The only `Vary` on these responses is `Origin`, which the CORS middleware adds (unless cross-origin requests are disabled, when there is no `Vary` at all). A shared cache or CDN in front of Pages that keys on the URL can therefore store the gzip or brotli body and serve it to a client that did not ask for it, or store the uncompressed body and serve it to one that did. RFC 9110 (section 12.5.5) says an origin server should send `Vary` when the representation it selects depends on request header fields. ### Steps to reproduce I reproduced it with `gitlab-pages` built from `master` (8d3ddba6fd28290b6b16a2cb88349f4c3534abc5), started against the GitLab API stub the acceptance tests use and the repository's `shared/pages` fixtures. In the `group.gitlab-example.com` fixture, `index.html` has `index.html.gz` and `index.html.br` siblings. ```shell go build -o /tmp/gitlab-pages . && go build -o /tmp/stub ./test/gitlabstub/cmd/server /tmp/stub -pages-root "$PWD/shared/pages" & # logs the URL it listens on # /tmp/secret holds GitLabAPISecretKey from internal/fixture/fixtures.go /tmp/gitlab-pages -listen-http 127.0.0.1:8090 -pages-root "$PWD/shared/pages" \ -internal-gitlab-server <stub URL> -api-secret-key /tmp/secret & curl -sI -H 'Host: group.gitlab-example.com' -H 'Accept-Encoding: gzip' http://127.0.0.1:8090/index.html curl -sI -H 'Host: group.gitlab-example.com' http://127.0.0.1:8090/index.html ``` The two responses, trimmed to the headers that matter: ```plaintext HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Encoding: gzip Content-Length: 34 Etag: "1204a83f928f61797447027a5ff51929a979770fce5df1cbe8f1de939affed8f-gzip" Vary: Origin HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Length: 3 Etag: "1204a83f928f61797447027a5ff51929a979770fce5df1cbe8f1de939affed8f" Vary: Origin ``` `Accept-Encoding: br` gives `Content-Encoding: br` and the same `Vary: Origin`. For artifacts, `TestArtifactProxyRequest` in `test/acceptance/artifacts_test.go` runs Pages against an artifact server stub that answers with `Content-Encoding: gzip` or `deflate`; with an assertion on `Vary` added, its responses carry only `Origin`. The Pages response headers quoted in #1167, for an artifact on GitLab 18.4.2, show the same: `Cache-Control: max-age=3600` and `Vary: Origin`. ### Current behavior The body depends on `Accept-Encoding`, the response is cacheable for 10 minutes (sites) or an hour (artifacts), and `Vary` does not mention `Accept-Encoding`. ### Expected behavior Every response whose body could have been chosen by `Accept-Encoding` carries `Vary: Accept-Encoding`, next to the existing `Vary: Origin`. ### Possible fix Add `Vary: Accept-Encoding` with `Header().Add`, so that `Vary: Origin` stays, at the top of `handleContentEncoding` and in the artifact proxy before it writes the relayed response. I have a merge request ready for it.