ACP2E-3069: Customers see prices from other customer groups

Author: abukatar

app/code/Magento/PageCache/Model/App/Response/HttpPlugin.php

@@ -8,12 +8,24 @@
 
 use Magento\Framework\App\PageCache\NotCacheableInterface;
 use Magento\Framework\App\Response\Http as HttpResponse;
+use Magento\Framework\App\Request\Http as HttpRequest;
+use Magento\Framework\App\Http\Context;
 
 /**
  * HTTP response plugin for frontend.
  */
 class HttpPlugin
 {
+    /**
+     * @param Context $context
+     * @param HttpRequest $request
+     */
+    public function __construct(
+        private Context $context,
+        private HttpRequest $request
+    ) {
+    }
+
     /**
      * Set proper value of X-Magento-Vary cookie.
      *
@@ -28,6 +40,13 @@ public function beforeSendResponse(HttpResponse $subject)
         ) {
             return;
         }
+
+        $currentVary = $this->context->getVaryString();
+        $varyCookie = $this->request->get(HttpResponse::COOKIE_VARY_STRING);
+        if ($currentVary !== $varyCookie) {
+            //prevent caching with the old vary cookie
+            $subject->setNoCacheHeaders();
+        }
         $subject->sendVary();
     }
 }

app/code/Magento/PageCache/Test/Unit/Model/App/Response/HttpPluginTest.php

@@ -7,7 +7,9 @@
 
 namespace Magento\PageCache\Test\Unit\Model\App\Response;
 
+use Magento\Framework\App\Http\Context;
 use Magento\Framework\App\Response\Http as HttpResponse;
+use Magento\Framework\App\Request\Http as HttpRequest;
 use Magento\MediaStorage\Model\File\Storage\Response as FileResponse;
 use Magento\PageCache\Model\App\Response\HttpPlugin;
 use PHPUnit\Framework\MockObject\MockObject;
@@ -23,13 +25,28 @@ class HttpPluginTest extends TestCase
      */
     private $httpPlugin;
 
+    /**
+     * @var Context|MockObject
+     */
+    private $context;
+
+    /**
+     * @var HttpRequest|MockObject
+     */
+    private $request;
+
     /**
      * @inheritdoc
      */
     protected function setUp(): void
     {
         parent::setUp();
-        $this->httpPlugin = new HttpPlugin();
+        $this->context = $this->createMock(Context::class);
+        $this->request = $this->createMock(HttpRequest::class);
+        $this->httpPlugin = new HttpPlugin(
+            $this->context,
+            $this->request
+        );
     }
 
     /**
@@ -62,4 +79,17 @@ public function beforeSendResponseDataProvider(): array
             'file_response_headers_sent' => [FileResponse::class, true, 0],
         ];
     }
+
+    public function testBeforeSendResponseVaryMismatch()
+    {
+        /** @var HttpResponse|MockObject $responseMock */
+        $this->context->expects($this->any())->method('getVaryString')->willReturn('currentVary');
+        $this->request->expects($this->any())->method('get')->willReturn('varyCookie');
+        /** @var HttpResponse|MockObject $responseMock */
+        $responseMock = $this->createMock(HttpResponse::class);
+        $responseMock->expects($this->once())->method('setNoCacheHeaders');
+        $responseMock->expects($this->once())->method('sendVary');
+
+        $this->httpPlugin->beforeSendResponse($responseMock);
+    }
 }