cc @UlisesGascon @troygoode @dougwilson

I have opened a PR that will close this issue. I tentatively set the package version to 2.9.0, because I believe this feature warrants a new minor version but does not warrant a new major version.

Apologies for the ping if you are no longer maintaining this package!

For anyone who encounters this:

It might be tedious, depending on how many routes you need to apply this to, but here's a function you can use to remove the Origin: Vary header after the cors middleware has been applied to your route.

export function removeVaryOriginHeader(res: Response) {
  const varyHeader = res.getHeader('Vary')
  if (typeof varyHeader === 'string' && varyHeader === 'Origin') {
    res.removeHeader('Vary')
  } else if (Array.isArray(varyHeader) && varyHeader.includes('Origin')) {
    const updatedVaryHeader = varyHeader.filter((header) => header !== 'Origin')
    res.setHeader('Vary', updatedVaryHeader)
  }
}

I opened a discussion on Slack (https://openjs-foundation.slack.com/archives/C02QB1731FH/p1711971438045899), I want to collect more feedback on this.

Feel free to join us in slack. invitation link

Edit: What are you setting for origin? Just a string? Doesn't matter rn for the actual behavior in the library, but if you are serving to different origins then removing vary would break things when the browser gets an Access-Control-Allow-Origin for a different origin than the request.

Hmm when we have a fixed origin like either * or mydomain.com the response headers won't actually vary based on origin. If we are using a fixed origin, then we get a fixed Access-Control-Allow-Origin header.

If I set origin: "https://example.com" then I will always get back Access-Control-Allow-Origin: https://example.com

Right now the code will set Vary: Origin for anything except *

That came in w/ #30

Im not sure that was correct though. The MDN link w/ the commit message says:

If the server specifies a single origin (that may dynamically change based on the requesting origin as part of an allowlist) rather than the * wildcard, then the server should also include Origin in the Vary response header to indicate to clients that server responses will differ based on the value of the Origin request header.

When not using an allowlist, we shouldn't need Vary: Origin. If you are using an allowlist, then it would be required due to the response headers changing based on origin.

Updates from the Fetch Spec, we shouldn't be setting Vary: origin for static or * origin option

https://fetch.spec.whatwg.org/#cors-protocol-and-http-caches

If CORS protocol requirements are more complicated than setting Access-Control-Allow-Origin to * or a static origin, Vary is to be used.