chore(middleware/cors): Add Vary header for non-CORS OPTIONS requests…

… comment
gofiber · Mar 26, 2024 · 8583dbb · 8583dbb
1 parent 2770faa
commit 8583dbb
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/middleware/cors/cors.go b/middleware/cors/cors.go
@@ -175,7 +175,10 @@ func New(config ...Config) fiber.Handler {
 
 		// If it's a preflight request and doesn't have Access-Control-Request-Method header, it's outside the scope of CORS
 		if c.Method() == fiber.MethodOptions && c.Get(fiber.HeaderAccessControlRequestMethod) == "" {
-			// See comment in preflight section below
+			// Response to OPTIONS request should not be cached but,
+			// some caching can be configured to cache such responses.
+			// To Avoid poisoning the cache, we include the Vary header
+			// for non-CORS OPTIONS requests:
 			c.Vary(fiber.HeaderOrigin)
 			return c.Next()
 		}