Always set `Vary: Origin` about stack-cors HOT 5 CLOSED

Adding a note here that we're bumping into this with sites that use this library and have different requests from different origins being stored in Varnish cache. In line with what @wimleers is observing, when the request comes from the same origin, the response doesn't include a Vary header that then causes CORS blockages for future requests that receive the cached response.

By always adding Vary: Origin, we'll cache different responses for each origin and the issue should be resolved.

from stack-cors.

Sounds fair.

@wimleers Could you work on a pull request? Since this library has been stable for a long time, perhaps we should put the "always reply with Vary: Origin" behavior behind a new configuration option.

from stack-cors.

Created a pull request that added an additional option 'alwaysSetVaryOrigin'. If not set (default), current behavior remains unchaged. When the flag is set, this library will add a Vary: Origin header to all responses.

from stack-cors.

Can you all try out #68 and see if it resolves your problem? I think it should fix the cacheability without adding new configuration.

from stack-cors.

I think this should all be fixed now.

from stack-cors.