vary CORS responses by origin

2026-09-06 18:18:19 +03:00
parent 7a3915a679
commit bdde4534f6
3 changed files with 10 additions and 0 deletions
@@ -629,6 +629,7 @@ function json(res, code, body) {
    'Referrer-Policy': 'no-referrer',
  };
  const origin = res.__ihaleistCorsOrigin;
+  if (CORS_ORIGINS.length) headers.Vary = 'Origin';
  if (origin) headers['Access-Control-Allow-Origin'] = origin;
  else if (!CORS_ORIGINS.length) headers['Access-Control-Allow-Origin'] = '*';
  res.writeHead(code, headers);
@@ -740,10 +741,12 @@ const server = http.createServer(async (req, res) => {
  res.__ihaleistCorsOrigin = CORS_ORIGINS.length && CORS_ORIGINS.includes(requestOrigin) ? requestOrigin : null;
  if (req.method === 'OPTIONS') {
    const headers = {
+      'Vary': CORS_ORIGINS.length ? 'Origin' : undefined,
      'Access-Control-Allow-Methods': 'GET,POST,PUT,PATCH,DELETE,OPTIONS',
      'Access-Control-Allow-Headers': 'Authorization,Content-Type',
      'Access-Control-Max-Age': '600',
    };
+    if (!headers.Vary) delete headers.Vary;
    if (res.__ihaleistCorsOrigin) headers['Access-Control-Allow-Origin'] = res.__ihaleistCorsOrigin;
    else if (!CORS_ORIGINS.length) headers['Access-Control-Allow-Origin'] = '*';
    res.writeHead(204, headers);