vary CORS responses by origin

2026-09-06 18:18:19 +03:00
parent 7a3915a679
commit bdde4534f6
3 changed files with 10 additions and 0 deletions
@@ -29,6 +29,7 @@ test('HTTP preparation requires auth, persists draft and rejects stale revisions
 const preflight=await fetch(base+'/api/me/plan',{method:'OPTIONS',headers:{Origin:'https://client.example', 'Access-Control-Request-Method':'GET', 'Access-Control-Request-Headers':'authorization,content-type'}});
 assert.equal(preflight.status,204);
 assert.equal(preflight.headers.get('access-control-allow-origin'),'https://client.example');
+ assert.equal(preflight.headers.get('vary'),'Origin');
 assert.equal(preflight.headers.get('access-control-allow-headers'),'Authorization,Content-Type');
 const denied=await fetch(base+'/api/me/plan',{method:'OPTIONS',headers:{Origin:'https://untrusted.example','Access-Control-Request-Method':'GET'}});
 assert.equal(denied.status,204);assert.equal(denied.headers.get('access-control-allow-origin'),null);