You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
🐛 [Bug]: compress middleware ignores no-transform on repeated response Cache-Control lines and misparses quoted directive arguments #4801
While #4708 updated shouldSkip in middleware/compress to check request Cache-Control: no-transform directives across repeated field lines and quoted directive arguments via c.HasHeaderValue(fiber.HeaderCacheControl, "no-transform"), the response check on the next line still calls headerlist.ContainsFold(c.GetRespHeader(fiber.HeaderCacheControl), "no-transform").
Because c.GetRespHeader reads only the first Cache-Control response field line and headerlist.ContainsFold splits on commas inside quoted directive arguments:
A no-transform directive added on a second response Cache-Control line (RFC 9110 §5.3 / RFC 9111 §5.2.2.6) is ignored and the response is compressed anyway.
A response header such as Cache-Control: public, ext="x,no-transform,y" is split inside the quotes and falsely treated as no-transform.
A response header with an escaped quote before no-transform (Cache-Control: ext="a\"", no-transform) fails to match no-transform.
shouldSkip in middleware/compress should honor no-transform across all response Cache-Control field lines and ignore commas inside quoted directive arguments, matching DefaultReq.HasHeaderValue.
Fiber Version
v3.1.0-beta / main
Code Snippet (optional)
package main
import"github.com/gofiber/fiber/v3"import"log"funcmain() {
app:=fiber.New()
// Steps to reproducelog.Fatal(app.Listen(":3000"))
}
Activity