fix: set Vary: X-Forwarded-Prefix on the injected index.html

The index.html body varies by the X-Forwarded-Prefix header (it drives
the injected <base href> and window.__BASE_PATH__). Without a matching
Vary header, a CDN or intermediate proxy could cache one prefix's
response and serve it to users on a different prefix — a cache-poisoning
vector that breaks routing / causes a denial of service. Advertise the
header so caches key responses per-prefix.

Signed-off-by: tittu.varghese <tittu.varghese@npci.org.in>

Author: tittuvarghese

src/app.controller.ts

@@ -24,6 +24,11 @@ export class AppController {
   @Get('*')
   index(@Req() req: Request, @Res() res: Response) {
     const basePath = resolveBasePath(req)
+    // The injected <base href>/window.__BASE_PATH__ depend on X-Forwarded-Prefix,
+    // so the response body varies by that header. Advertise it via Vary so any
+    // CDN/intermediate proxy caches responses per-prefix instead of serving one
+    // prefix's index.html to everyone (cache-poisoning / broken-routing risk).
+    res.setHeader('Vary', 'X-Forwarded-Prefix')
     res.type('html').send(this.renderIndex(basePath))
   }