From 675656c18ccfcf589875691910a59dc04c429e79 Mon Sep 17 00:00:00 2001 From: Paul Bakaus Date: Fri, 31 Jul 2026 18:06:55 -0700 Subject: [PATCH] Assert Vary: Origin on the authorized CORS preflight too Review follow-up: the reflected-origin contract matters most on the OPTIONS preflight, where a cached response authorized for one origin must never be served to another. Co-Authored-By: Claude Fable 5 --- tests/live-server.test.mjs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/live-server.test.mjs b/tests/live-server.test.mjs index 87b9725a1..d4556649e 100644 --- a/tests/live-server.test.mjs +++ b/tests/live-server.test.mjs @@ -431,6 +431,10 @@ describe('live-server integration', () => { }); assert.equal(preflight.status, 204); assert.equal(preflight.headers.get('access-control-allow-origin'), origin); + assert.ok( + /\bOrigin\b/i.test(preflight.headers.get('vary') || ''), + 'Vary: Origin accompanies the reflected origin on the preflight too', + ); }); it('CORS: a loopback origin is reflected with Vary: Origin', async () => {