[wp-trac] [WordPress Trac] #38060: Add Vary: Origin to CORS responses

[WordPress Trac]

#38060: Add Vary: Origin to CORS responses
-------------------------+-----------------------------
 Reporter:  pdufour      |      Owner:
     Type:  enhancement  |     Status:  new
 Priority:  normal       |  Milestone:  Awaiting Review
Component:  General      |    Version:
 Severity:  normal       |   Keywords:
  Focuses:               |
-------------------------+-----------------------------
 I think enough WP setups have some caching engine like Varnish installed
 that it'd be useful to have a 'Vary: Origin' header on any responses that
 have a `Access-Control-Allow-Origin` header.

 Steps to replicate:
 Send CURL request to WP API with a custom origin. See that the it returns
 with `Access-Control-Allow-Origin: custom origin` but does not have a
 `Vary: Origin` header so if you have a caching engine installed and send
 another request with a separate origin than the first, it will still
 return `custom origin`.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/38060>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform