Invalid Vary header in Access-Control-Allow-Headers

[shdpl]

Invalid Vary header in Access-Control-Allow-Headers

[shdpl]

I can't walk through the issue I've had to reproduce my thinking ATM, but what you're writing makes 100% sense. That wouldn't be logical to introduce a server-side header to verify other headers set by the server. I will take a look on the whole thing again later, including rereading the spec, but I think I just made some mistake in reasoning about the problem I had and the way I "fixed" it. I'm answering and closing the issue right away because I don't want to clutter your issue tracker.

[jub0bs]

@shdpl No. Access-Control-Allow-Headers is a response header, and listing response header names in Vary is pointless. Vary expects a comma-separated list of request header names, such as Access-Control-Request-Headers or Origin; see https://httpwg.org/specs/rfc9110.html#field.vary