cdn - Why isn't 'Vary: Origin' response set on a CORS miss?

link之家

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Learn more about Collectives

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Learn more about Teams

When making a CORS request, if the requested Origin is on the list of allowed origins, the response contains both the Access-Control-Allow-Origin header, and the Vary: Origin header.

The Vary: Origin telling onward CDNs etc that the response was negotiated based on the requestors Origin header value.

The issue is (and I've tested the leading CDN providers), is that if the requestor doesn't provide a Origin header in their request, or an Origin value that is not one of the allowed ones, the response does not include the Vary: Origin in the response.

Should a CDN preforming CORS always respond with Vary: Origin in the response headers? If it doesn't a CDN would believe it can serve the same response to any Origin value. Then again, it would be possible to fill a CDNs cache by making many requests with random origin values.

Yes. If a request may contain a Access-Control-Allow-Origin with different values, then the CDN should always respond with Vary: Origin , even for responses without an Access-Control-Allow-Origin header. Your analysis is correct: if the header isn't always present, it would be possible to fill the cache with incorrect values.

Just what I thought. I was doubting myself as Amazon CloudFront and Azure CDN only return Vary: Origin when the Origin is present and matches, and otherwise ignores it. Only Google outputs Vary: Origin for every request. I wonder why there is so little about this issue on the web? – simbolo Aug 15, 2014 at 16:22 It doesn't come up very often (since there are fewer CORS implementations that whitelist origins, most just use *), and when it does, it is difficult to debug. I have a section on this in CORS in Action. – monsur Aug 15, 2014 at 16:31 When using Amazon CloudFront with a web origin (not S3), forwarding the Origin header from CloudFront to your origin will avoid this issue. Is that correctly understood? docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/… – Eric Eijkelenboom Jan 14, 2016 at 10:34 Actually, this is causing some issues with Chrome: bugs.chromium.org/p/chromium/issues/detail?id=260239 . No wonder Google would outputs Vary: Origin for every request – Gyum Fox Jul 3, 2020 at 16:20

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question . Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers .