[ResponseCaching] Correctly handle Vary: * in delimited or multi-value headers (RFC 9111) (#69210)

* Do not cache responses with Vary: * across multiple or delimited headers

- Comply with RFC 9111 § 4.1 by inspecting each delimited token within Vary headers.
- Iterate StringValues directly with StringTokenizer to prevent string allocations on hot paths.
- Add unit and integration tests covering multi-entry and delimited '*' headers.

Fixes #69192

* Use Span.Split for zero-allocation Vary header tokenization

* Update src/Middleware/ResponseCaching/src/ResponseCachingPolicyProvider.cs

Co-authored-by: Jiri Cincura ↹ <jiri@cincura.net>

* Update src/Middleware/ResponseCaching/src/ResponseCachingPolicyProvider.cs

Co-authored-by: Jiri Cincura ↹ <jiri@cincura.net>

---------

Co-authored-by: Jiri Cincura ↹ <jiri@cincura.net>

Author: Sadik00789

src/Middleware/ResponseCaching/src/ResponseCachingPolicyProvider.cs

@@ -99,10 +99,22 @@ public bool IsResponseCacheable(ResponseCachingContext context)
 
         // Do not cache responses varying by *
         var varyHeader = response.Headers.Vary;
-        if (varyHeader.Count == 1 && string.Equals(varyHeader, "*", StringComparison.OrdinalIgnoreCase))
+        for (var i = 0; i < varyHeader.Count; i++)
         {
-            context.Logger.ResponseWithVaryStarNotCacheable();
-            return false;
+            var rawHeader = varyHeader[i].AsSpan();
+            if (rawHeader.IsEmpty)
+            {
+                continue;
+            }
+
+            foreach (var segment in rawHeader.Split(','))
+            {
+                if (rawHeader[segment].Trim() is ['*'])
+                {
+                    context.Logger.ResponseWithVaryStarNotCacheable();
+                    return false;
+                }
+            }
         }
 
         // Check private

src/Middleware/ResponseCaching/test/ResponseCachingMiddlewareTests.cs

@@ -1,10 +1,16 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System.Net.Http;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Http.Features;
 using Microsoft.AspNetCore.InternalTesting;
+using Microsoft.AspNetCore.TestHost;
 using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging.Testing;
 using Microsoft.Extensions.Primitives;
 using Microsoft.Extensions.Time.Testing;
@@ -1051,4 +1057,67 @@ public void GetOrderCasingNormalizedStringValues_PreservesCommas()
 
         Assert.Equal(originalStrings, normalizedStrings);
     }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task ResponseWithVaryStar_AndDownstreamMiddlewareAppendedVaryHeader_IsNotServedFromCache(bool appendStarFirst)
+    {
+        using var host = new HostBuilder()
+            .ConfigureWebHost(webHostBuilder =>
+            {
+                webHostBuilder
+                    .UseTestServer()
+                    .ConfigureServices(services =>
+                    {
+                        services.AddResponseCaching();
+                    })
+                    .Configure(app =>
+                    {
+                        app.UseResponseCaching();
+                        app.Use(async (context, next) =>
+                        {
+                            if (!appendStarFirst)
+                            {
+                                context.Response.Headers.Append("Vary", "Accept-Encoding");
+                            }
+                            await next(context);
+                        });
+                        app.Run(async context =>
+                        {
+                            context.Response.Headers.CacheControl = new CacheControlHeaderValue
+                            {
+                                Public = true,
+                                MaxAge = TimeSpan.FromSeconds(10)
+                            }.ToString();
+                            if (appendStarFirst)
+                            {
+                                context.Response.Headers.Vary = "*";
+                                context.Response.Headers.Append("Vary", "Accept-Encoding");
+                            }
+                            else
+                            {
+                                context.Response.Headers.Append("Vary", "*");
+                            }
+                            await context.Response.WriteAsync(Guid.NewGuid().ToString());
+                        });
+                    });
+            })
+            .Build();
+
+        await host.StartAsync();
+
+        using var server = host.GetTestServer();
+        var client = server.CreateClient();
+        var initialResponse = await client.GetAsync("");
+        var subsequentResponse = await client.GetAsync("");
+
+        initialResponse.EnsureSuccessStatusCode();
+        subsequentResponse.EnsureSuccessStatusCode();
+
+        Assert.False(subsequentResponse.Headers.Contains(HeaderNames.Age));
+        var initialContent = await initialResponse.Content.ReadAsStringAsync();
+        var subsequentContent = await subsequentResponse.Content.ReadAsStringAsync();
+        Assert.NotEqual(initialContent, subsequentContent);
+    }
 }

src/Middleware/ResponseCaching/test/ResponseCachingPolicyProviderTests.cs

@@ -1,8 +1,9 @@
-// Licensed to the .NET Foundation under one or more agreements.
+// Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Logging.Testing;
+using Microsoft.Extensions.Primitives;
 using Microsoft.Net.Http.Headers;
 
 namespace Microsoft.AspNetCore.ResponseCaching.Tests;
@@ -229,23 +230,54 @@ public void IsResponseCacheable_SetCookieHeader_NotAllowed()
             LoggedMessage.ResponseWithSetCookieNotCacheable);
     }
 
-    [Fact]
-    public void IsResponseCacheable_VaryHeaderByStar_NotAllowed()
+    public static TheoryData<StringValues> VaryHeaderWithStarData
+    {
+        get
+        {
+            return new TheoryData<StringValues>
+            {
+                "*",
+                new StringValues(["*", "Accept-Encoding"]),
+                "*, Accept-Encoding",
+                "Accept-Encoding, *",
+                "gzip, *, br"
+            };
+        }
+    }
+
+    [Theory]
+    [MemberData(nameof(VaryHeaderWithStarData))]
+    public void IsResponseCacheable_VaryHeaderByStar_NotAllowed(StringValues vary)
     {
         var sink = new TestSink();
         var context = TestUtils.CreateTestContext(sink);
         context.HttpContext.Response.Headers.CacheControl = new CacheControlHeaderValue()
         {
             Public = true
         }.ToString();
-        context.HttpContext.Response.Headers.Vary = "*";
+        context.HttpContext.Response.Headers.Vary = vary;
 
         Assert.False(new ResponseCachingPolicyProvider().IsResponseCacheable(context));
         TestUtils.AssertLoggedMessages(
             sink.Writes,
             LoggedMessage.ResponseWithVaryStarNotCacheable);
     }
 
+    [Fact]
+    public void IsResponseCacheable_ValidVaryHeaderWithoutAsterisk_Allowed()
+    {
+        var sink = new TestSink();
+        var context = TestUtils.CreateTestContext(sink);
+        context.HttpContext.Response.Headers.CacheControl = new CacheControlHeaderValue()
+        {
+            Public = true
+        }.ToString();
+        context.HttpContext.Response.Headers.Vary = "Accept-Encoding, User-Agent";
+
+        Assert.True(new ResponseCachingPolicyProvider().IsResponseCacheable(context));
+        Assert.Empty(sink.Writes);
+    }
+
     [Fact]
     public void IsResponseCacheable_Private_NotAllowed()
     {