From b1c6d08ebefd99b901bf716411f3584ea71f742d Mon Sep 17 00:00:00 2001
From: Divyanshu Garg <divyanshugarg36@gmail.com>
Date: Fri, 28 Aug 2026 03:14:37 +0530
Subject: [PATCH] fix: add Vary: Origin so caches key CORS responses per-origin

Responses are cacheable (cacheControl maxAge 21600) and carry a
per-origin Access-Control-Allow-Origin, but sent no Vary header. Shared
caches therefore keyed only by URL, so a response cached under one origin
was replayed to another origin on the same base domain (which share a
browser cache partition), serving the wrong Access-Control-Allow-Origin
and failing CORS. Varying on Origin makes caches store a copy per origin.
---
 app.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app.js b/app.js
index f792d47..c1854c1 100644
--- a/app.js
+++ b/app.js
@@ -32,6 +32,10 @@ if (config.length > 1) {
 }
 
 // app
+app.use((req, res, next) => {
+  res.vary('Origin');
+  next();
+});
 app.use(cors());
 app.use(cacheControl({ maxAge: 21600 }));
 app.use(bodyParser.urlencoded({ extended: true }));