S3: Add Vary header for non-wildcard AllowOrigin (#7547)

2025-11-25 22:19:34 +08:00
parent 935c641f25
commit a24c31de06
2 changed files with 6 additions and 0 deletions
--- a/weed/s3api/cors/cors.go
+++ b/weed/s3api/cors/cors.go
@@ -361,6 +361,10 @@ func ApplyHeaders(w http.ResponseWriter, corsResp *CORSResponse) {

 	if corsResp.AllowOrigin != "" {
 		w.Header().Set("Access-Control-Allow-Origin", corsResp.AllowOrigin)
+
+		if corsResp.AllowOrigin != "*" {
+			w.Header().Add("Vary", "Origin")
+		}
 	}

 	if corsResp.AllowMethods != "" {