From d68ffea80dc7540b9553320b7249752ed45e4c55 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Wed, 21 Oct 2020 10:34:38 -0400
Subject: [PATCH] feat: send 'Vary' header when ACAO header set

---
 src/middleware/headers.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/middleware/headers.js b/src/middleware/headers.js
index 03efe7c077..27d5558e4d 100644
--- a/src/middleware/headers.js
+++ b/src/middleware/headers.js
@@ -34,6 +34,7 @@ module.exports = function (middleware) {
 
 			if (origins.includes(req.get('origin'))) {
 				headers['Access-Control-Allow-Origin'] = encodeURI(req.get('origin'));
+				headers.Vary = headers.Vary ? `${headers.Vary}, Origin` : 'Origin';
 			}
 		}
 
@@ -52,6 +53,7 @@ module.exports = function (middleware) {
 			originsRegex.forEach(function (regex) {
 				if (regex && regex.test(req.get('origin'))) {
 					headers['Access-Control-Allow-Origin'] = encodeURI(req.get('origin'));
+					headers.Vary = headers.Vary ? `${headers.Vary}, Origin` : 'Origin';
 				}
 			});
 		}