Added security notice to route versioning docs (#2679)

* Added security notice to route versioning docs

* Updated test

* Bumped find-my-way

docs/Routes.md

@@ -431,6 +431,24 @@ fastify.inject({
 })
 ```
 
+> ## ⚠  Security Notice
+> Remember to set a [`Vary`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Vary) header in your
+> responses with the value you are using for defining the versioning (e.g.: `'Accept-Version'`),
+> to prevent cache poisoning attacks. You can also configure this as part your Proxy/CDN.
+> 
+> ```js
+> const append = require('vary').append
+> fastify.addHook('onSend', async (req, reply) => {
+>   if (req.headers['accept-version']) { // or the custom header you are using
+>     let value = reply.getHeader('Vary') || ''
+>     const header = Array.isArray(value) ? value.join(', ') : String(value)
+>     if ((value = append(header, 'Accept-Version'))) { // or the custom header you are using
+>       reply.header('Vary', value)
+>     }
+>   }
+> })
+> ```
+
 If you declare multiple versions with the same major or minor, Fastify will always choose the highest compatible with the `Accept-Version` header value.<br/>
 If the request will not have the `Accept-Version` header, a 404 error will be returned.
 

package.json

@@ -174,7 +174,7 @@
     "fast-json-stringify": "^2.2.1",
     "fastify-error": "^0.2.0",
     "fastify-warning": "^0.2.0",
-    "find-my-way": "^3.0.0",
+    "find-my-way": "^3.0.5",
     "flatstr": "^1.0.12",
     "light-my-request": "^4.2.0",
     "pino": "^6.2.1",

test/pretty-print.test.js

@@ -39,10 +39,8 @@ test('pretty print - parametric routes', t => {
 
     const expected = `└── /
     ├── test (GET)
-    │   └── /
-    │       └── :hello (GET)
-    └── hello/
-        └── :world (GET)
+    │   └── /:hello (GET)
+    └── hello/:world (GET)
 `
 
     t.is(typeof tree, 'string')
@@ -62,12 +60,11 @@ test('pretty print - mixed parametric routes', t => {
   fastify.ready(() => {
     const tree = fastify.printRoutes()
 
-    const expected = `└── /
-    └── test (GET)
-        └── /
-            └── :hello (GET)
-                :hello (POST)
-                └── /world (GET)
+    const expected = `└── /test (GET)
+    └── /
+        └── :hello (GET)
+            :hello (POST)
+            └── /world (GET)
 `
 
     t.is(typeof tree, 'string')
@@ -88,10 +85,8 @@ test('pretty print - wildcard routes', t => {
 
     const expected = `└── /
     ├── test (GET)
-    │   └── /
-    │       └── * (GET)
-    └── hello/
-        └── * (GET)
+    │   └── /* (GET)
+    └── hello/* (GET)
 `
 
     t.is(typeof tree, 'string')

test/versioned-routes.test.js

@@ -6,6 +6,7 @@ const Fastify = require('..')
 const sget = require('simple-get').concat
 const http = require('http')
 const split = require('split2')
+const append = require('vary').append
 
 test('Should register a versioned route', t => {
   t.plan(11)
@@ -476,3 +477,57 @@ test('Should register a versioned route with custome versioning strategy', t =>
     t.strictEqual(res.statusCode, 404)
   })
 })
+
+test('Vary header check (for documentation example)', t => {
+  t.plan(8)
+  const fastify = Fastify()
+  fastify.addHook('onSend', async (req, reply) => {
+    if (req.headers['accept-version']) { // or the custom header you are using
+      let value = reply.getHeader('Vary') || ''
+      const header = Array.isArray(value) ? value.join(', ') : String(value)
+      if ((value = append(header, 'Accept-Version'))) { // or the custom header you are using
+        reply.header('Vary', value)
+      }
+    }
+  })
+
+  fastify.route({
+    method: 'GET',
+    url: '/',
+    handler: (req, reply) => {
+      reply.send({ hello: 'world' })
+    }
+  })
+
+  fastify.route({
+    method: 'GET',
+    url: '/',
+    version: '1.2.0',
+    handler: (req, reply) => {
+      reply.send({ hello: 'world' })
+    }
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: {
+      'Accept-Version': '1.x'
+    }
+  }, (err, res) => {
+    t.error(err)
+    t.deepEqual(JSON.parse(res.payload), { hello: 'world' })
+    t.strictEqual(res.statusCode, 200)
+    t.strictEqual(res.headers.vary, 'Accept-Version')
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/'
+  }, (err, res) => {
+    t.error(err)
+    t.deepEqual(JSON.parse(res.payload), { hello: 'world' })
+    t.strictEqual(res.statusCode, 200)
+    t.strictEqual(res.headers.vary, undefined)
+  })
+})