Fix: Copilot suggested fixes

- Fix go version in dockerfile

- Enhance CORS middleware to append Vary header

Author: rashmithachamikara

portal/backend/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.23 AS builder
+FROM golang:1.26.3 AS builder
 WORKDIR /app
 COPY . .
 RUN go mod download && go build -o /out/bff ./cmd/server

portal/backend/internal/middleware/cors.go

@@ -50,7 +50,7 @@ func CORS(next http.Handler, options CORSOptions) http.Handler {
 			return
 		}
 
-		w.Header().Set("Vary", "Origin")
+		appendVary(w.Header(), "Origin")
 		w.Header().Set("Access-Control-Allow-Origin", origin)
 		w.Header().Set("Access-Control-Allow-Methods", allowMethods)
 		w.Header().Set("Access-Control-Allow-Headers", allowHeaders)
@@ -78,3 +78,14 @@ func toSet(values []string) map[string]struct{} {
 	}
 	return out
 }
+
+func appendVary(header http.Header, value string) {
+	for _, existing := range header.Values("Vary") {
+		for _, part := range strings.Split(existing, ",") {
+			if strings.EqualFold(strings.TrimSpace(part), value) {
+				return
+			}
+		}
+	}
+	header.Add("Vary", value)
+}

portal/backend/tests/unit/cors_middleware_test.go

@@ -21,6 +21,7 @@ package unit
 import (
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/wso2/openfgc/portal/backend/internal/middleware"
@@ -113,3 +114,42 @@ func TestCORSMiddleware_HandlesPreflight(t *testing.T) {
 		t.Fatalf("expected Access-Control-Allow-Credentials=true, got %q", got)
 	}
 }
+
+func TestCORSMiddleware_AppendsVaryOrigin(t *testing.T) {
+	next := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	corsHandler := middleware.CORS(next, middleware.CORSOptions{
+		AllowedOrigins: []string{"http://localhost:3000"},
+		AllowedMethods: []string{"GET"},
+		AllowedHeaders: []string{"Content-Type"},
+	})
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Vary", "Accept-Encoding")
+		corsHandler.ServeHTTP(w, r)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/me/consents", nil)
+	req.Header.Set("Origin", "http://localhost:3000")
+	res := httptest.NewRecorder()
+
+	handler.ServeHTTP(res, req)
+
+	vary := strings.Join(res.Header().Values("Vary"), ",")
+	if !headerListContains(vary, "Accept-Encoding") {
+		t.Fatalf("expected Vary to retain Accept-Encoding, got %q", vary)
+	}
+	if !headerListContains(vary, "Origin") {
+		t.Fatalf("expected Vary to include Origin, got %q", vary)
+	}
+}
+
+func headerListContains(headerValue, expected string) bool {
+	for _, part := range strings.Split(headerValue, ",") {
+		if strings.EqualFold(strings.TrimSpace(part), expected) {
+			return true
+		}
+	}
+	return false
+}