CORS Preflight response includes Vary:Origin and Access-Control-Max-Age?

Question

I would like to know how browsers handle CORS Preflight response that includes both Vary: Origin and Access-Control-Max-Age headers.

This statement is from https://www.w3.org/TR/cors/

Resources that wish to enable themselves to be shared with multiple Origins but do not respond uniformly with "*" must in practice generate the Access-Control-Allow-Origin header dynamically in response to every request they wish to allow. As a consequence, authors of such resources should send a Vary: Origin HTTP header or provide other appropriate control directives to prevent caching of such responses, which may be inaccurate if re-used across-origins

From this statement I understand Vary: Origin will tell browsers prevent a cache of Preflight response (In case allow-origin: * not used)

Access-Control-Max-Age will tell browsers will cache preflight response for a period.

The questions:

1. Is it valid if both of the headers exist in a preflight response?

2. How browsers handle Preflight response if the response includes both that headers?

Thanks!

Answer 1

Per the spec requirements Vary: Origin won’t affect behavior of the CORS-preflight cache.

Is it valid if both of the headers exist in a preflight response?

Yes it’s valid. But if the Vary header is present, it has no affect on the CORS-preflight cache.

How browsers handle Preflight response if the response includes both that headers

For the CORS-preflight cache, browsers completely ignore the Vary header and only use the value of the Access-Control-Max-Age header.

my understand is Vary: Origin will tell browsers won't cache preflight result

That’s not what the requirements in the Fetch spec say.

The CORS-preflight cache isn’t a general HTTP cache covered by requirements in the HTTP spec. It’s a special cache whose behavior is defined exclusively by the Fetch spec. And the Fetch spec doesn’t state any requirements—even indirectly—about the behavior of the CORS-preflight cache being affected at all by the Vary response header.

Instead the Fetch spec says just this:

Let max-age be the result of extracting header list values given Access-Control-Max-Age and response’s header list.

That doesn’t say anything about checking the Vary header value before setting max-age.

And because the spec doesn’t explicitly state if/how to use Vary when deciding whether to populate the CORS-preflight cache, then browsers must not use Vary when doing it.

If a browser did use Vary in its handling of the CORS-preflight cache, then that browser would be out of conformance with the spec requirements for the CORS-preflight cache.