the header must be in response

src/NoFLoCMiddleware.php

@@ -13,8 +13,10 @@ final class NoFLoCMiddleware implements MiddlewareInterface
 {
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
     {
-        $request = $request->withHeader('Permission-Policy', 'interest-cohort=()');
+        $response = $handler->handle($request);
 
-        return $handler->handle($request);
+        $response->withAddedHeader('Permission-Policy', 'interest-cohort=()');
+
+        return $response;
     }
 }

test/NoFLoCMiddlewareTest.php

@@ -6,6 +6,7 @@
 
 use Antidot\NoFLoC\NoFLoCMiddleware;
 use PHPUnit\Framework\TestCase;
+use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
 use Psr\Http\Server\RequestHandlerInterface;
 
@@ -15,10 +16,15 @@ public function testItShouldSetPermissionsPolicyHeaderAsInterestCohort(): void
     {
         $handler = $this->createMock(RequestHandlerInterface::class);
         $request = $this->createMock(ServerRequestInterface::class);
-        $request->expects($this->once())
-            ->method('withHeader')
+        $response = $this->createMock(ResponseInterface::class);
+        $handler->expects(self::once())
+            ->method('handle')
+            ->with($request)
+            ->willReturn($response);
+        $response->expects(self::once())
+            ->method('withAddedHeader')
             ->with('Permission-Policy', 'interest-cohort=()')
-            ->willReturn($request);
+            ->willReturn($response);
 
         $middleware = new NoFLoCMiddleware();
         $middleware->process($request, $handler);