Add "Access-Control-Request-Private-Network" to Vary (#132)

rs · Oct 3, 2022 · fcebdb4 · fcebdb4
1 parent da52b07
commit fcebdb4
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/cors.go b/cors.go
@@ -287,6 +287,9 @@ func (c *Cors) handlePreflight(w http.ResponseWriter, r *http.Request) {
 	headers.Add("Vary", "Origin")
 	headers.Add("Vary", "Access-Control-Request-Method")
 	headers.Add("Vary", "Access-Control-Request-Headers")
+	if c.allowPrivateNetwork {
+		headers.Add("Vary", "Access-Control-Request-Private-Network")
+	}
 
 	if origin == "" {
 		c.logf("  Preflight aborted: empty origin")

diff --git a/cors_test.go b/cors_test.go
@@ -401,7 +401,7 @@ func TestSpec(t *testing.T) {
 				"Access-Control-Request-Private-Network": "true",
 			},
 			map[string]string{
-				"Vary":                                 "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
+				"Vary":                                 "Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Access-Control-Request-Private-Network",
 				"Access-Control-Allow-Origin":          "http://foobar.com",
 				"Access-Control-Allow-Methods":         "GET",
 				"Access-Control-Allow-Private-Network": "true",