TYPO3 Core

When you have an extbase action which is cacheable (within TYPO3 cache) and which returns a response with custom headers, those custom headers are only sent when it's not returned from cache.

Example Action:

<?php
public function indexAction(): ResponseInterface {
    return $this->htmlResponse()
        ->withHeader('Content-Type', 'application/json;charset=utf-8')
        ->withHeader('X-Custom-Header', 'test')
    ;
}

If this action is not part of the nonCacheableActions in TYPO3\CMS\Extbase\Utility\\ExtensionUtility::configurePlugin, the first call to this action will return the correct headers and the second call will return the string content from TYPO3 cache.

curl -o /dev/null -s -D - 'https://www.example.com'
HTTP/1.1 200 OK
...
Content-Type: application/json;charset=utf-8
X-Custom-Header: test
...

curl -o /dev/null -s -D - 'https://www.example.com'
HTTP/1.1 200 OK
...
Content-Type: application/json;charset=utf-8
...
(No X-Custom-Header)

The Content-Type header will be saved in the cache, but other headers won't be saved.

The problem exists in Extbases Bootstrap or TypoScriptFrontendController:
https://github.com/TYPO3/typo3/blob/6199bdd0b0e29e54a1762c786c2344bfe24b0267/typo3/sysext/extbase/Classes/Core/Bootstrap.php#L137

Because the (string) result of Extbase is cached and the headers are only sent in Bootstrap::handleFrontendRequest which is not called when the content is restored from cache.