Consider adding a "Vary":"Origin" HTTP response header in SockJS implementation [SPR-12310]

[spring-projects-issues]

Brian Clozel opened SPR-12310 and commented

The current SockJS implementation sends CORS HTTP headers in some cases, including a "Access-Control-Max-Age" header that specifies how long the client should keep that response in cache (even though some browsers don't follow that advice).

For the sake of completeness, our implementation could also send a "Vary":"Origin" header in order to tell browsers and proxies that the current response is cachable but varies on the "Origin" HTTP request header.

---

This issue is a sub-task of #16921

[spring-projects-issues]

Brian Clozel commented

See this thread in the SockJS discussion list.