Access-Control-Allow-Origin pointing to an origin should include Vary: Origin

[Malvoz]

When Access-Control-Allow-Origin points to a URL rather than *, then Vary: Origin should be sent along with the response.

Sources:

• https://fetch.spec.whatwg.org/#cors-protocol-and-http-caches
• https://w3c.github.io/webappsec-cors-for-developers/#use-vary
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin#CORS_and_caching
• https://textslashplain.com/2018/08/02/cors-and-vary/

All of the CORS configs use * in the examples. But if anything, there could potentially be a note of this in requests.conf? Or something better than just a note?

[LeoColomb]

A note seems to be a good start. 👍

Maybe the note can be attached to a commented out directive:

# (1)
# Header append Vary Origin