[API] Use weak comparison for If-None-Match validation

CHANGELOG.md

@@ -6,6 +6,7 @@
 
 ### Fixed
 
+- [API] Use weak comparison for `If-None-Match` validation.
 - [Request] Treat IPv6 literals as non-domain hosts.
 - [Router] Fall back to `SERVER_NAME` when deriving exact host constraints.
 - [Cookies] Use request host fallback when resolving cookie domains.

lib/rage/request.rb

@@ -271,8 +271,10 @@ def etag_matches?(requested_etags:, response_etag:)
 
     return true if requested_etags.empty?
     return false if response_etag.nil?
+    return true if requested_etags.include?("*")
 
-    requested_etags.include?(response_etag) || requested_etags.include?("*")
+    response_etag = weak_etag(response_etag)
+    requested_etags.any? { |requested_etag| weak_etag(requested_etag) == response_etag }
   end
 
   def not_modified?(request_not_modified_since:, response_last_modified:)
@@ -282,6 +284,10 @@ def not_modified?(request_not_modified_since:, response_last_modified:)
     request_not_modified_since >= response_last_modified
   end
 
+  private def weak_etag(etag)
+    etag.delete_prefix("W/")
+  end
+
   # @private
   class Headers
     HTTP = "HTTP_"

spec/controller/api/conditional_get_spec.rb

@@ -180,12 +180,12 @@ def last_modified_set_raises_error
       let(:env) { { "HTTP_IF_NONE_MATCH" => "\"#{Digest::SHA1.hexdigest("123")}\"" } }
       let(:expected_etag) { %(W/"#{Digest::SHA1.hexdigest("123")}") }
 
-      it "renders the requested resource" do
+      it "returns NOT MODIFIED" do
         expect(run_action(klass, :stale_etag_test, env:)).to match(
-          [200, a_hash_including(
+          [304, a_hash_including(
             Rage::Response::ETAG_HEADER => expected_etag,
             Rage::Response::LAST_MODIFIED_HEADER => nil
-          ), ["test_etag"]]
+          ), []]
         )
       end
     end