diff --git a/util/http.py b/util/http.py
index 6d704c62e2..ad4c5cd9dd 100644
--- a/util/http.py
+++ b/util/http.py
@@ -26,6 +26,7 @@ def _abort(status_code, data_object, description, headers):
     headers["Access-Control-Allow-Methods"] = options_resp.headers["allow"]
     headers["Access-Control-Max-Age"] = str(21600)
     headers["Access-Control-Allow-Headers"] = ["Authorization", "Content-Type"]
+    headers["Vary"] = "Origin"
 
     resp = make_response(json.dumps(data_object), status_code, headers)