Why add Vary on Access-Control-Request-Method, ACRH and origin when OPTIONS method is not cacheable?

Question

I found go implementation of CORS and it adds on every CORS request following headers:

headers.Add("Vary", "Origin")
headers.Add("Vary", "Access-Control-Request-Method")
headers.Add("Vary", "Access-Control-Request-Headers")

https://github.com/rs/cors/blob/f9bce55a4e61e3d1a061993e3453eb9848fcdc4d/cors.go#L269

But as far as I know OPTIONS method is not cacheable?

So why they add that Vary header?

Answer 1

OPTIONS method can be cached by intermediary caches.

For example:

If you want OPTIONS responses to be cached, do the following:(...)

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/header-caching.html